Legally Sound Tenant Screening: Credit Checks & Self-Disclosure
Key takeaways
- The further along the process, the more data may be collected – staged by phase.
- Identification and contact details suffice for the viewing.
- A credit report only when lease conclusion is imminent.
- Request only the plain credit report, not the full SCHUFA self-disclosure.
- Delete rejected applicants' data on time (~6 months) and ensure equal treatment under the AGG.
Tenant selection is delicate. On one side, the landlord has a legitimate interest in finding a solvent, reliable tenant. On the other, the GDPR protects applicants from excessive data collection. Reconciling both means selecting fairly, quickly and on solid legal ground. (This article focuses on the German market.)
What you may ask, and when
Not every question is permissible at every stage. A rule of thumb: the further an applicant is in the process, the more may be collected. The data protection authorities follow a three-phase model.
| Phase | Permitted data |
|---|---|
| First enquiry & viewing | identification and contact details |
| After selection | proof of income and employment |
| Before signing | credit report (from the chosen applicant) |
- At the first enquiry and the viewing, identification and contact details suffice – no sensitive financial data.
- After selection, you may request proof of income and employment.
- Only when signing is imminent is a credit report appropriate – as a rule, only from the chosen applicant.
Off-limits are questions unrelated to the tenancy – such as family planning, religion or political affiliation.
The self-disclosure
The self-disclosure (Selbstauskunft) is the usual tool to collect relevant information in a structured way. The key is to ask only what's necessary for the decision: name, address, number of people moving in, employment status and proof of income. Anything beyond that is optional and voluntary.
Credit checks: yes, but proportionate
A credit report – such as the SCHUFA credit check meant for presentation to third parties, or a comparable report – may only be requested when conclusion of the lease is imminent. That means: not from every prospect across the board, but only from the chosen applicant, ideally provided by them. You may request only the plain credit report – not the full SCHUFA self-disclosure (the Art. 15 GDPR data copy), which contains all stored information. This keeps data collection proportionate.
Review proofs rather than hoarding copies
From a data protection view: store as little as possible permanently. Income proofs or ID documents often only need to be checked, not archived. Where copies are required, unnecessary details should be redacted.
Rejected applicants: delete on time
Once the data of unsuccessful applicants is no longer needed for the selection process, it must be deleted – as a rule within about six months at the latest. A limited retention within that window can be justified to defend against potential claims under the General Equal Treatment Act (AGG); beyond it, the data must be deleted under Art. 17 GDPR. Central management that bundles applications per unit makes timely sorting and deletion simple and traceable.
Ensure equal treatment
Germany's General Equal Treatment Act prohibits disadvantaging applicants on grounds including origin, gender, religion or disability. A standardized selection process with the same criteria for everyone protects not only applicants but also the landlord from accusations of discrimination.
Decide faster with a clear process
The more structured the process, the faster the decision – and the shorter the vacancy. When self-disclosure, proofs and communication for each prospect sit in one place, you can say yes within days of a viewing instead of weeks.
In Immo Manager, enquiries, prospect data and documents converge – and the chosen applicant becomes a tenant without duplicate data entry. More for agents on our real estate agent software page.
Note: This article offers general orientation and is not legal advice.
Frequently asked questions
Which questions are permitted in the self-disclosure?
Only what is necessary for the decision: name, address, number of people moving in, employment status and proof of income. Questions unrelated to the tenancy – such as family planning, religion or political affiliation – are off-limits.
When may I request a SCHUFA or credit report?
Only when conclusion of the lease is imminent – that is, from the chosen applicant. You may request only the plain credit report, not the full SCHUFA self-disclosure (the Art. 15 GDPR data copy).
May I keep copies of ID and income proofs?
As little as possible. Often a review suffices rather than permanent storage. Where copies are required, unnecessary details should be redacted.
How long may I keep rejected applicants' data?
Only as long as needed for the selection process, as a rule within about six months at the latest. After that it must be deleted.
What protects against accusations of discrimination?
A standardized selection process with the same criteria for everyone. Germany's General Equal Treatment Act (AGG) prohibits disadvantaging applicants on grounds including origin, gender, religion or disability.