GDPR for landlords: How to handle personal data correctly

GDPR - three letters that cause concern for anyone who works with people's data. As a landlord, you process tenants' personal data on a daily basis: names, addresses, social security numbers, account numbers. How to do it right and avoid fines?

In this article I will show you practically what GDPR means for rentals and how to comply with it without stress.

What is GDPR

The basic principle

GDPR (General Data Protection Regulation) is an EU regulation on the protection of personal data. It is valid from May 25, 2018.

Who it concerns

Anyone who processes personal data of natural persons - i.e. also apartment landlords.

What is personal data

Examples for rent:

• Name and surname
• Date of birth
• Social security number
• Address
• E-mail and phone
• Bank account number
• Photos of the apartment with persons

Fines

Up to EUR 20 million or 4% of annual turnover. Realistically rather lower amounts for landlords, but still unpleasant.

When you can process data

Legal titles for processing

1. Fulfillment of the contract: You need data for the rental contract - name, address, contact.

2. Legal obligation: The law requires certain data – reporting of foreigners, tax obligations.

3. Legitimate interest: Protection of property - but you must consider tenant's rights.

4. Consent: For data you don't necessarily need - marketing, photos.

In practice

Data	Legal Title
Name, surname	Fulfillment of the contract
Date of birth	Fulfillment of the contract
Social security number	Fulfillment of the contract (identification)
Address	Fulfillment of the contract
Email, phone	Fulfillment of the contract
Account Number	Fulfillment of the contract
Identity document	Only if necessary, proportionate and supported by a lawful basis
Photo of person	Consent or another applicable lawful basis

What information to collect

Minimum required

For the rental agreement:

• Name and surname
• Date of birth (or social security number)
• Address of permanent residence
• Contact information (e-mail, telephone)
• Bank account number

Other general information

For verification creditworthiness:

• Confirmation of employment
• Amount of income
• Reference from previous landlord

For records:

• Copy of ID

What NOT TO COLLECT

If not necessary:

• Health data
• Children's data (beyond the number of people)
• Religious beliefs
• Political opinions
• Sexual orientation

How to keep data

Security

Physical documents:

• Lockable cabinet or safe
• Access only by authorized person
• Shredder disposal

Electronic data:

• Passwords and encryption
• Backup
• Antivirus protection
• Restricted access

Retention period

Rule: Retain only for the time necessary for the purpose of processing.

Practically:

• During the lease: Everything necessary
• After the end of the lease: retain only for the applicable legal, tax, accounting or limitation period

Phase	Data	Time
Interested	Contact, requirements	Only as long as necessary for the stated purpose
After the lease	Tax-relevant records	For the period required by the applicable rules
After the applicable retention period	-	Delete or securely destroy where no legal basis remains

Tenants' rights

Right to information

You must inform what data you are processing and why.

How:

• Clause in the lease agreement
• Separate document "Information on personal data processing"

Right to access

The tenant can request an overview of their data.

Deadline: 1 month to answer.

Right to rectification

If the data is inaccurate, you must correct it.

Right to erasure

"Right to be forgotten" - but beware, you can't always erase.

When YOU CAN erase:

• You no longer need the data
• Consent has been revoked
• The processing was unlawful

When you CANNOT:

• You have a legal obligation to keep
• There is a legal dispute

Right to object

The tenant can object to the processing on the basis of legitimate interest.

Practical steps

1. Map the data

Create list:

• What data do you collect
• Why do you need it
• Where do you store it
• Who do you give it to

2. Keep it to a minimum

Collect only what you really need.

3. Secure

Physically and electronically protect against unauthorized access.

4. Inform

Let tenants know how you handle their data.

5. Set deadlines

Define when to delete data.

6. Document

Record how you comply with GDPR.

Information clause

What must be included

• Who is the data controller (you)
• Purpose of processing
• Legal basis
• Recipients of data
• Retention period
• Rights of subjects

Sample wording

"The lessor processes the tenant's personal data for the purpose of fulfilling the rental agreement and related obligations. The legal basis is the fulfillment of the agreement and legal obligations. The data is kept for the duration of the lease and subsequently for established by law for archiving. The tenant has the right to access, correct and delete data to the extent provided by law."

To whom you can transfer

Without consent (performance of contract, law):

• House manager, SVJ
• Service provider (energy)
• Financial office
• Insurance company damage)

With consent:

• Marketing purposes
• Referrals to third parties

Processing agreement

If someone else processes data for you (accountant, administrator), conclude a processing agreement.

Common mistakes

Error 1: Collecting "for surety"

Example: Copy of the birth certificate of the tenant's children.

Solution: Collect only necessary data.

Error 2: Unlimited retention

Example: Contracts of old tenants since 1995.

Solution: Shred after the deadlines.

Error 3: Unsecured data

Example: Contracts in an unlocked drawer.

Solution: Lock, encrypt, protect.

Error 4: Missing information

Example: Tenant does not know what you are doing with their data.

Solution: Inform within the contract or separately.

Summary: GDPR checklist

Collection of data:

• Only necessary data
• Clear legal title
• Informing the tenant

Storage:

• Secure storage
• Limited access
• Defined periods

Deletion:

• After the end of the purpose
• Respecting the legal deadlines
• Documentation

Tenants' rights:

• Response within 1 month
• Correction of inaccuracies
• Deletion (when possible)

GDPR is not a scarecrow – it is common sense in legal form. Process data fairly, securely and transparently - and problems will pass you by.

> Czech-law scope and editorial note: Legal, tax, accounting, tenancy, service-charge, condominium, metrology, insurance and data-protection statements in this article refer to the Czech Republic and the rules effective for the relevant date. Figures and examples are illustrative, not legal or tax advice. Verify current rules with the relevant Czech authority or a qualified adviser.

> Data-protection clarification: Under GDPR, collect and retain only data that are necessary for a specified purpose and supported by a lawful basis. A full identity copy, employer contact, bank statement, tax return, emergency contact or ten-year retention period is not automatically justified.