Personal Data (GDPR)

Personal Data (GDPR) - According to Article 4(1) of the GDPR, personal data refers to any information relating to an identified or identifiable natural person. In the real estate industry, this includes, in particular, names, addresses, proof of income, credit history data, and photos of prospective tenants, buyers, and owners. As data controllers, real estate agents, property management companies, and owners are subject to the strict requirements of the GDPR.

Relevant Data in the Real Estate Business

When renting or selling, sensitive data is regularly collected: self-reported information including proof of income, credit reports, copies of ID cards, bank statements, and marital status. Real estate agents may only collect this data to the extent necessary for the initiation or performance of the contract (Art. 6(1)(b) GDPR). After the lease agreement is concluded or in the event of rejection, data on rejected applicants must be deleted within 6 months, unless there is a legal obligation to retain it. Property management companies also store consumption data, collections of resolutions, and correspondence with owners.

The collection of health data or data regarding ethnic origin in the context of tenant selection is particularly sensitive. This data is subject to special protection under Art. 9 GDPR and may generally not be collected. Indirect discrimination through targeted questions (e.g., regarding nationality or marital status) is also prohibited and may give rise to claims for damages under the AGG. We regularly train our employees on what information may be collected during the application process.

Obligations for Brokers and Property Managers

Real estate companies must maintain a record of processing activities (Art. 30 GDPR), inform data subjects transparently about data processing (privacy policy), and implement technical and organizational measures to protect the data. If there are more than 20 employees who regularly process personal data, a data protection officer must be appointed. Violations can result in fines of up to 20 million euros or 4% of annual turnover. Particularly common mistakes include: sending tenant data via an open email distribution list, failing to delete application documents within the required timeframe, or conducting video surveillance in common areas without a legal basis.

The same rules apply to homeowners’ associations (WEGs) and their managers: The WEG administration processes the personal data of all owners and is required to enter into a data processing agreement (DPA) with the WEG administrator. Owners have the right to access their stored data as well as to correct and delete inaccurate information.

Practical Tip for Owners in Nuremberg

We recommend that landlords and homeowners’ associations in the Nuremberg metropolitan area regularly review their data protection processes. Especially when renting to new tenants, a standardized deletion policy for application documents should be in place. Ensure that your property management company has entered into a data processing agreement (DPA) with you in accordance with Article 28 of the GDPR. For video surveillance in underground garages or building entrances, a legitimate interest must be demonstrated, and the surveillance must be indicated by signage. If in doubt, consulting the Bavarian State Office for Data Protection Supervision (BayLDA) in Ansbach-the competent supervisory authority for Bavaria-can be helpful.

As real estate agents, we process our clients’ personal data in accordance with the provisions of the GDPR and have implemented appropriate technical and organizational measures. Our privacy policy provides comprehensive information about all processing activities. For us, data protection is not merely a bureaucratic requirement, but part of our commitment to trustworthiness and the professional handling of sensitive information.

Frequently Asked Questions

Can the landlord request a SCHUFA credit report from a prospective tenant?

Yes, but only at an advanced stage of the contract negotiation process-that is, once the prospective tenant has made the shortlist. A blanket request during the initial viewing is disproportionate. The landlord may only request the tenant credit report (not the full self-disclosure report) and must inform the prospective tenant in advance about the data processing. The SCHUFA report must be deleted in a timely manner after the contract is signed or the application is rejected.

How long may tenant data be stored after the contract ends?

After the tenancy ends, data may be retained for as long as statutory retention periods apply or legitimate interests exist. Tax-relevant documents (utility bills, proof of payment) must be retained for 10 years. Contract documents are subject to a 6-year retention requirement. Any additional data, such as correspondence or photos of the apartment, must be deleted after the 3-year statute of limitations has expired.

Is video surveillance permitted in a multi-unit residential building?

Video surveillance in common areas (entrance, underground garage) is only permitted if there is a legitimate interest-such as documented break-ins or vandalism-and less intrusive measures (better lighting, locks) are insufficient. Surveillance must be announced by clearly visible signs. Private areas (apartment doors, balconies) may not be recorded. In a condominium association (WEG), video surveillance must be approved by a resolution of the owners’ meeting with a simple majority.

Do property listing photos require special treatment under data protection law?

If people are depicted in photos of the property, this constitutes personal data that requires the consent of the person depicted. Photos should therefore generally be taken without visible people. Photos that allow conclusions to be drawn about the resident (personal items, family photos) should also be removed or retouched before publication.

Data Protection in Digital Property Management

Modern property management software and digital owner portals process a significant amount of personal data: tenant payments, utility usage data, communication histories, and key records. For property management companies in Bavaria, the Bavarian State Office for Data Protection Supervision (BayLDA) in Ansbach is the competent supervisory authority. It publishes guidance specifically for the real estate industry and has conducted multiple audits of property management companies in recent years.

Particularly relevant for digital operations: If a property management company uses a cloud service or an external software solution for data management, a data processing agreement (DPA) must be concluded with the software provider in accordance with Article 28 of the GDPR. If this agreement is missing, a data protection violation has occurred-even if the data is actually processed securely. We recommend that homeowners’ associations and landlords specifically ask for a property management company’s GDPR documentation when selecting one and request to see the DPA.

What applies when tenant data is shared with tradespeople or service providers?

When a property management company discloses tenants’ contact information (name, phone number, access codes) to tradespeople or maintenance service providers-for example, to coordinate a repair appointment-this constitutes the disclosure of personal data. This is permitted under Article 6(1)(b) of the GDPR, provided it is necessary for the performance of a contract. However, the property management company may only disclose the data necessary for the specific purpose-not all available tenant information across the board. Tradespeople and service providers, for their part, should be required to handle data with care through a confidentiality agreement.

Back to the Real Estate Glossary.