GDPR as a landlord —what you really need to watch out for
As a landlord you process other people's data — tenants, former tenants, prospective tenants. This makes you subject to the GDPR. We explain the 5 most important obligations, the most common mistakes and how to avoid fines of up to 20,000 €.
Why you too are subject to the GDPR
As soon as you, as a landlord, process data of tenants, prospective tenants or other natural persons — i.e. store, pass on, delete or analyse —, the GDPR applies. Even an Excel list with tenant addresses + dates of birth makes you a controller within the meaning of Art. 4 No. 7 GDPR.
Oversight is handled by the data protection authority of your federal state. Fines up to €20 million or 4% of annual turnover are possible — in the landlord context, 1,000–25,000 € per violation is realistic.
The 5 most important obligations
1. Information obligation (Art. 13/14 GDPR)
At first contact with the tenant (enquiry from a prospective tenant, tenancy agreement, self-disclosure form) you must provide information about:
- Who you are (name, address, contact)
- Which data you collect (name, address, IBAN, occupation, income)
- Why (administering the tenancy, creditworthiness, dunning)
- How long you store it (10 years after the end of the tenancy)
- Which rights the tenant has (access, rectification, erasure, complaint)
Practical implementation: an A4 privacy notice attached to the tenancy agreement. A standard template is available free of charge.
2. Record of processing activities (Art. 30 GDPR)
Mandatory for every landlord, regardless of size. A list of all processing activities: "tenant data management", "rent payment processing", "service-charge statement creation", etc. Per activity: purpose, data categories, recipients, deletion periods.
3. Deletion obligations (Art. 17 GDPR)
As soon as the purpose ceases to apply, data must be deleted. Standard periods:
- Prospective tenants without a contract: 6 months (evidence in the event of AGG violations)
- Terminated tenancies: 10 years (tax record-keeping)
- Reminders/debt collection: 30 years (limitation period for monetary claims)
- Landlord confirmation of residence: 2 years
Caution: once the period expires you MUST delete the data, not merely may.
4. Right of access (Art. 15 GDPR)
If a (even former) tenant asks: "What data do you hold about me?" — you must provide a complete answer within 1 month. Including all stored data, purposes, recipients and deletion periods.
5. Data processing agreements (Art. 28 GDPR)
If you use services that process tenant data (cloud software, tax adviser, caretaker company, email provider) — you need data processing agreements.
The 7 most common mistakes
- A tenant self-disclosure form left unsecured in a WhatsApp photo
- Tenant data in an unencrypted email (e.g. to the tax adviser)
- Schufa enquiry without the tenant's consent (prohibited following the 2024 Federal Court of Justice ruling)
- Sharing creditworthiness data with new landlords (prohibited)
- Old tenant data not deleted (e.g. Excel file from 2018)
- Advertising to former tenants without consent
- Tenant photos on the landlord's website without consent
How Rentprime helps you
Rentprime is Auftragsverarbeiter nach Art. 28 DSGVO set up: data processing agreement (AVV) digitally within 2 minutes, core and tenant data encrypted in the EU (application database Stockholm/Sweden, compute Frankfurt and Stockholm; ISO-27001 hosting providers); AI functions as well as frontend/API hosting via, among others, Vercel, Fly.io, Supabase, Cloudflare, Resend, Postmark, Twilio, Anthropic, Google (USA), DPF/SCC-safeguarded, automatic deletion suggestions at the end of the tenancy, complete data export for access requests (UK GDPR + DPA 2018 export module).
Related topics: Our privacy policy · Download the data processing agreement · Security architecture