What is the landlord allowed to know? - Data protection in the tenancy

The GDPR also applies to landlords. You can find out here which data the landlord may ask for at which stage of the tenancy and which rights the tenant has under data protection law.

Principle: It depends!

In any case, the principle of data economy applies to the landlord's collection of data from the tenant. This means that only as much data as necessary may be requested. At the same time, the landlord may only request data that he currently needs for a specific purpose.

Which data these are in each case usually differs according to the stage of the tenancy relationship at which the (potential) tenant and landlord are currently standing. As is so often the case, it all depends!

Stage 1: Prospective tenant

If a (potential) tenant contacts the landlord because he is interested in an offered apartment, contact data of the tenant such as name, address, telephone number and email address are collected in the first place. These may be collected as long as there is a purpose for doing so. If the prospective tenant has withdrawn his interest, the corresponding data must be deleted again.

In the case of an inspection, the landlord may also require the presentation of an identity card (real document, no copies, no copying) for identity verification. The same applies to a certificate of eligibility for housing.

Stage 2: Application phase

If the landlord has to decide between several potential tenants, he may obtain further data from the tenant for the purpose of making the decision (tenant's self-disclosure). The limits of this self-disclosure lie in the highly personal sphere of the tenant's life.

For example, the landlord may ask for information on creditworthiness (Schufa information, proof of income, etc.), professional activity, the number of people moving in and the intended keeping of pets. In contrast, the landlord may not request information on marital status, pregnancy, nationality, religion, political or sexual orientation, criminal record, health data or membership in trade unions, rental associations or political parties.

Stage 3: Conclusion of contract

If a contract is initiated, the landlord may ask for data that is relevant for the contract. This also includes data that is necessary for the exercise of the tenancy. This includes, above all, data on account details and any guarantee agreements.

Stage 4: Existing tenancy

Even during the existing tenancy, the tenant's data continues to be protected by data protection. Unless there is a duty to retain data, data whose purpose has ceased to apply must be deleted immediately.

In principle, the landlord has no right to enter the rented property during the current tenancy. This would again violate the tenant's personal sphere of life. Entering the rented property must therefore be agreed with the tenant and requires the tenant's consent. These rules also apply to the property management.

In the course of a tenancy, the landlord may also order a craftsman to repair the rented property. (Contact) data of the tenant may only be processed with the consent of the tenant. Learn more about the disclosure of data here.

The landlord may also have the tenant's data processed by a third party (e.g. meter reading services). This is then a so-called Job processing. The landlord then remains responsible for processing.

Rights of the tenant

If the landlord asks questions during the application phase that he is not allowed to ask, the potential tenant may lie or refuse to answer without incurring any consequences.

In addition, the tenant has a right to information from the landlord at any time about what data was collected about him by the landlord, when and for what purpose.

If the landlord violates the tenant's data protection, there is a risk of sanctions under data protection law. Following a review by the competent data protection authorities, a fine may even be imposed.

Tips for landlords

As a landlord, it is advisable to keep a log of all data collection and, if necessary, consent at all stages. At the same time, this log can be used to fulfill the obligation to keep a register of data processing activities. Learn more about this obligation here, on the content and structure of such a directory here.

Are you still unsure about data protection? Our team of experts will be happy to assist you. Contact us here.