Data privacy in rental agreements: What is permitted?

Personal data is required to conclude a rental agreement. However, since the introduction of the GDPR in 2018, data protection requirements regarding tenancies have become significant. Therefore, both tenants and landlords should inform themselves about how to handle sensitive data.

Data protection in rental agreements: What do landlords need to consider under the GDPR?

During the initiation of a tenancy the landlord requires certain personal data, such as proof of income, to assess the creditworthiness of potential tenants. The GDPR, however, contains several strict regulations here: Above all, the landlord must be aware of which data may be collected for the rental agreement under the GDPR and which may not.

The collection of data that affects the highly personal sphere of life is not permitted. If a tenancy is already in place, it is equally important to follow GDPR regulations. For example, a landlord may not visit the apartment regularly without a reason. This would only be lawful if the tenants gave their consent.

In principle, the GDPR provides for the following general principles in connection with data protection and rental agreements:

• Purpose limitation
• Transparency, fairness, and lawfulness
• Data minimization
• Accuracy
• Integrity/confidentiality
• Storage limitation.

Legal basis: What regulations does the GDPR contain for landlords?

Not only companies but also private individuals must comply with the General Data Protection Regulation regarding the rental agreement comply. Failure to do so may result in fines or claims for damages. The legal basis for data processing in a tenancy is described in Art. 6 (2) GDPR. In principle, data processing must be purpose-bound and based on a legitimate interest, such as a contractual relationship. In addition, landlords should observe the following:

• Data collection and storage should be kept to a minimum, and the necessity of collecting specific data must be justified.
• In accordance with the principle of data minimization (Art. 5 (1c) GDPR) and the principle of necessity, data must generally be deleted once the tenancy has ended.
• Landlords must inform tenants about how their data will be used (duty to inform).
• If data is transferred, certain information must be encrypted and anonymized.

What tenant data is a landlord allowed to request?

In principle, prospective tenants only need to provide information that is relevant to the conclusion or fulfillment of the rental agreement, such as income status or the number of people moving in. During a property viewing, landlords are not permitted to ask about the financial circumstances of potential tenants. Other information that tenants are generally not required to provide relates to the following particularly sensitive personal data:

• Religious affiliation
• Ethnic origin
• Nationality
• Pregnancy
• Criminal record
• Hobbies
• Smoking status
• Trade union membership
• Sexual orientation
• Political views.

If a private landlord asks questions about the aforementioned characteristics, tenants may refuse to answer without legal consequences following. However, in highly competitive housing markets, such as those in many metropolitan areas, failing to answer such questions often becomes a deal-breaker, even though this is not legally permissible.

To reconcile the interests of both parties, tenants can complete a voluntary tenant self-disclosure form before signing the contract. This tenant questionnaire can also include the aforementioned aspects and, in the best-case scenario, helps tenants and landlords build a better relationship based on trust.

What tenant data may be shared, and why is a tenant consent form required?

If a landlord shares tenant data, this constitutes the processing of personal data under Art. 4 No. 10 GDPR, such as obtaining credit reports (Schufa) or other email communication with the tenant. However, this requires a legal basis. If there is a valid reason for the landlord to share specific tenant data, they should explain the situation and the recipient of the data to the tenants as precisely as possible. It is also necessary to point out the voluntary nature and revocability of the consent.

If costs or expenses arise from the processing of contact data, the landlord may not demand reimbursement from the tenants. If the tenancy ends or if data was collected before the tenancy began, the landlord is obligated to delete it. Regardless of how consent is handled, organizational efforts will arise, which are best managed in consultation with a data protection officer.

Is a privacy policy required for rentals?

Landlords must explain which tenant data they process and what happens to it before the tenancy begins. Such a notice must include the following aspects:

• Name and contact details of the landlord
• Legal basis for data processing
• Duration of data storage
• Reason for data collection
• Fundamental rights of tenants regarding data protection
• Right to lodge a complaint with the data protection authority for tenants
• Tenant consent may be withdrawn at any time
• Recipients of data in the event of data transfer.

For the points mentioned, it is advisable to draft a corresponding privacy policy and to update it continuously as changes occur. To ensure that all tenants can view it at any time in the future, the privacy policy can, for example, be posted on the notice board in the hallway. You can create your own with just a few clicks using our privacy policy template.