Choosing a good tenant is the most important step in letting a flat. But along the way you handle personal data, so GDPR applies to you too, even if you only let one flat. The good news: screening tenants lawfully isn't complicated. You just need to do it deliberately.
The basic rule: only what you really need
One of the core principles of data protection is data minimisation. Ask for as much data as you need to decide whether the applicant can pay and is reliable. How this looks from the tenant's side is covered in this article.
Two more principles help you find your way:
- Purpose limitation: only use data for the purpose you asked for it. Proof of income is for judging whether someone can pay, nothing else.
- Storage limitation: only keep it as long as the purpose requires.
The applicant should also know what you handle, why and for how long. You don't need a long document for this, but a short notice, even in the listing or your first message, goes a long way.
What you can usually ask for
- Name and contact details, so you can get in touch.
- Proof of income, such as an employer's certificate or a bank statement showing the relevant lines.
- A reference from a previous landlord or employer, with the applicant's consent.
- An identity check when signing the contract: you look at the document, but you don't need to copy it.
With income, the point isn't exactly how much the applicant earns, but whether the rent and utilities are in a realistic proportion to it. A common rule of thumb: housing costs shouldn't take more than a third of net income.
What you'd better not ask for
- Photocopies or photos of ID documents "just in case".
- Full bank statements with every transaction.
- Data on health, religion, political views or family planning.
- Social media passwords or the applicant's access to any account.
Equal treatment matters too. You can't turn someone down because of their origin, religion, nationality or a similar protected characteristic. You can, however, if their income doesn't cover the rent or their references are bad.
What about the credit register (KHR)?
As a landlord, you can't request data about an applicant from the Central Credit Information System (Központi Hitelinformációs Rendszer, KHR). The applicant, however, can request an extract of their own data and show it to you if they want. You can only offer this as an option; making it mandatory isn't a good idea. The Verified Passport does this with the tenant's consent, through the provider, and you only receive a summary of the result.
What to do with the data
Only keep it as long as you need it. Delete the documents of applicants you didn't choose once you've decided. Don't send them around by email, and don't store them in a shared folder.
The chosen tenant's data can stay for the length of the contract. After that, keep only what you need for legal reasons, such as the contract and the settlements. If several people can access the documents, for example a manager and an accountant, each should only see what they need for their work. We wrote about this in our article on team permissions.
A practical schedule
- In the listing, state what data you'll ask applicants for. Our article on writing a good listing covers this too.
- In the first round, only ask for an introduction and basic details.
- After the viewing, ask serious applicants for proof of income and a reference.
- When signing the contract, check their identity.
- After you decide, delete the other applicants' documents.
FAQ
Can I photocopy the tenant's ID card?
It's usually not necessary, and it can conflict with the principle of data minimisation. It's enough to look at it when you sign and write the details into the contract.
Can I ask for a deposit instead of proof of income?
They measure different things. The deposit covers damage and late payment; income shows whether the tenant can pay in the long run. Read more in our article on deposits.
How long can I keep rejected applicants' documents?
Only as long as you need them to decide. Then delete them.
The simpler way
With the Rentkey Passport, the tenant uploads and verifies their own data. You only see a summary with a score, and the documents stay with them. That means less data for you to handle, and less risk too.
