GDPR for landlords – Part I Data protection must also be observed in the rental relationship

von Nadja-Maria

Credit information, wage and salary statements, information on the number of children and pets. This list is only a small overview of the personal data that are usually processed in the context of a tenancy. To protect this data and the rights and freedoms of the tenants concerned, landlords must also observe the General Data Protection Regulation. In the current blog post “GDPR for landlords” we inform you about some of the basic requirements that the GDPR places on landlords. In Part II of the article, we then turn to specific case studies in which data protection in the rental relationship must be observed.

Basic rules of the GDPR for landlords

Collect and use only necessary data

In most cases, rental contracts are concluded for an indefinite period of time or leases with a term of several years are quite common, especially in the area of ​​residential rental. Against this background, it is understandable that landlords would like to obtain extensive information about potential tenants. In particular, information on the financial situation is often part of the query from the landlord in order to reduce financial risks from the tenancy.

However, landlords must not disregard the potential tenants’ right to informational self-determination. Therefore, with each requested information, it is important to pay attention to whether the knowledge is necessary for the landlord.

Note the voluntary nature of a declaration of consent

In the tenancy, too, as explained above, the necessity of data processing must be strictly observed. Especially with regard to the legal bases Art. 6 Para. 1 lit b GDPR (initiation and fulfillment of the lease) and Art. 6 Para. 1 lit. f GDPR (legitimate interest of the landlord) there are narrow limits here.

It could therefore make sense to base some data processing operations on the consent of the (potential) tenant under data protection law.

But caution is advised here. The voluntary consent of the person concerned is also important in the tenancy. Especially when applying for a rental apartment, this voluntariness can be disputed if tenants are urgently dependent on a rental apartment for personal reasons.

Inform tenants in advance

The obligation of Art. 13 and Art. 14 GDPR to inform the (potential) tenant about data processing also applies to landlords. It should be noted that, depending on the point in time, different information must be given to the persons concerned. E.g. In the context of the application for a rental property, different data may be processed than during the term of the rental agreement.

Observance of the security precautions for data processing

As already mentioned above, a lot of personal data is processed in the context of a tenancy. This also affects some particularly sensitive information, such as B. shows the credit check of potential tenants. This also has an impact on the security precautions to be taken for data processing in accordance with Art. 32. It is important to ensure that the security precautions are also appropriate in relation to the sensitivity of the data being processed.

A strict rights and role concept with regard to tenant data should be singled out here. This is the only way to ensure that only authorized persons can take note of the tenant data.

For more information, please also see Part II of the blog series “GDPR for landlords” soon.

Do you need competent advice on data protection and information security in your company? We are glad to be here for you. Simply contact us using our contact form, or by phone on +49 (0) 8505 91927-0.


Nadja-Maria leitet unser Inhouse-Juristen-Team. Sie studierte an der Universität Passau Rechtswissenschaften mit anschließendem Referendariat sowie erstem und zweitem Staatsexamen. Ihr Spezialgebiet ist Datenschutzrecht. Ihr fundiertes Wissen hält sie jederzeit aktuell. Für unsere Kunden und unser Team hat sie so immer einen Rat für eine passgenaue Lösung parat.