Data protection in the real estate industry
Property management companies, real estate agents, housing associations, and homeowners' association (WEG) managers process substantial volumes of personal data every day: from the first inquiry by a prospective tenant, through credit checks, to ongoing tenant administration and utility billing.
GDPR applies in full — and data protection in the real estate industry has its own pitfalls.
Prospective tenants and applicants
Personal data is generated as early as the apartment viewing. The self-disclosure form is the classic example: name, date of birth, income, occupation, household size — all of this is personal data.
What's allowed?
Only data that is necessary for deciding on a tenancy. Name, contact details, proof of income, number of household members: permissible. Marital status, nationality, religious affiliation: not permissible as selection criteria.
How long may applicant data be stored?
After a rejection, applicant data should be deleted — at the latest after a few weeks, once there is no longer a legitimate interest in retaining it. Exception: if discrimination claims are to be expected, a short retention period for legal defense purposes may be reasonable.
Credit checks and SCHUFA
Credit checks via SCHUFA or other credit agencies are standard practice in letting. Strict rules apply:
- The individual concerned must be informed
- Consent or a legitimate interest must exist
- Checks should only be carried out shortly before contract conclusion (not for every prospective tenant)
Tenant data in ongoing administration
Lease agreements, utility billing, correspondence, maintenance orders — tenant data is processed for all of this. This is generally permissible on the basis of the lease agreement (Art. 6(1)(b) GDPR), but subject to purpose limitation and data minimization.
Important: managers and owners must clearly define who processes what. This is particularly relevant in WEG (homeowners' association) management: the manager acts for the community of owners and must accordingly enter into a DPA with the WEG.
Video surveillance in residential buildings and common areas
Cameras at the building entrance, stairwell, or underground garage entrance are a common data protection topic in property management:
- Signage requirement with notices
- Only necessary areas (not apartment entrances)
- Limited retention period (generally 72 hours)
- Clear accountability (property manager or WEG?)
- In tenancies: tenants must be informed
Property management software and digital tools
Modern property management software (e.g., Hausbank, Domus, iMRent, Casavi) processes tenant data on your behalf. A Data Processing Agreement with the software provider is required here.
The same applies to online portals (tenant portals), digital billing tools, and communication platforms.
WEG management: owner data
In WEG management, owner data is processed — contact details, ownership shares, voting records, bank details. This data may only be used for administrative purposes and is subject to GDPR.
Owner lists may not simply be handed out to all unit owners without further consideration — clarification is needed on a case-by-case basis.