Landlord tenant documents and GDPR: what you may keep

Which tenant documents may a landlord ask for and keep under the GDPR? Only what each step of the letting needs, for as long as it needs them. “I only need to check who they are, not keep a copy of their whole ID.” That instinct is the rule: the GDPR asks you to process personal data that is “limited to what is necessary” for your purpose (Article 5(1)(c)). Here’s what that means at each step, and why holding less is safer for you.

Tenant documents under GDPR: what you need, step by step

Germany’s data protection authorities have set this out step by step for landlords (DSK guidance, in German). It is German guidance; the rule it rests on is the GDPR, which applies across the EU.

• The viewing. Name, first name and address. Questions about income are usually not needed yet.
• The applicant says they want to rent. Some further questions can now be needed, such as who will live in the home.
• You have chosen your tenant, just before signing. Now proof of income can be asked for: a payslip, a bank statement or a tax assessment, as a copy, with the details you don’t need blacked out. What to cover on each: redact a bank statement or payslip.

Some checks need more. In England, the right-to-rent check is the landlord’s own check, which ends with a full copy the landlord makes; see when a full ID copy is required.

Seeing an ID is not copying it

To confirm who an applicant is, look at their ID and note that you checked it. The DSK guidance is direct: a landlord may check the details against an ID card that is shown and record that the check took place, but making a copy of the ID “is not necessary and therefore not permitted”.

The same applies to any receiver of IDs, not only landlords: should you keep a copy of customer ID? And when you hire rather than let, the steps change but the logic doesn’t: job applicant documents and the GDPR.

What you hold is what can leak

Every copy you receive is a copy you must protect, list and later delete. A full ID or a complete bank statement in your files is exposed in any breach of those files, whatever caused it. A copy you never received can’t leak from your files.

The GDPR builds this in. Article 25 asks you to make sure that, by default, only the personal data needed for each specific purpose is processed. Asking for less is the simplest way to meet it.

Delete what you no longer need

The DSK guidance is clear about deletion, too:

• Applicants you don’t sign with. Delete their data once you no longer need it to decide (Article 17(1)(a) GDPR). In Germany, where a rejected applicant could bring a discrimination claim, the guidance sets a limit of 6 months as a rule.
• Your new tenant. Delete what you collected to decide on them if you don’t need it to run the tenancy.

Behind both is the GDPR’s storage limitation: keep personal data no longer than the purpose requires (Article 5(1)(e)).

Ask for less: the request kit

The easiest copy to protect is the one applicants never send. Our request kit gives you what to ask for, document by document, and a ready message that asks applicants to send only that, covered and marked for you. It points them to a free tool that works on their own device. Applicants who want to read up first can start with how to send an ID copy safely.

This article is not legal advice. Check what the law in your country requires of you.