GDPR for Landlords: Tenant Data Done Right

References, PPS numbers, arrears files and the camera in the hallway — a landlord is a data controller, and the rules are manageable once known.

A landlord letting even one property processes personal data continuously: applications and references, identity documents, PPS numbers for RTB registration, bank details, correspondence, arrears records, and sometimes CCTV. Letting is not a household activity for data purposes — the landlord is a controller, and the same principles that govern any small business apply, scaled to a portfolio of one or twenty.

The good news: landlord compliance is a bounded exercise — collect proportionately, store securely, retain to a schedule, and answer requests properly. The friction points are predictable, and this guide walks them.

Applications, references and vetting

At application stage, proportionality is the rule: identity, employment and landlord references, and ability to pay are legitimate; fishing beyond them is not. Collect the full documentation only from the tenant you proceed with, and delete unsuccessful applicants' data on a short cycle rather than warehousing it. Contacting referees is fine — recording their comments accurately matters, because the applicant can access them later.

PPS numbers are collected for RTB registration; treat them as restricted data — needed for the statutory purpose, stored securely, not scattered through email threads.

During the tenancy

The tenancy file — agreement, correspondence, inspection notes, arrears and payment records — rests on contract and legitimate interests, and it should be kept somewhere controlled: a folder structure, not a phone camera roll and three email accounts. Inspection photographs should record the property's condition, not the tenant's possessions and life, and sharing tenant details with tradespeople should be limited to what the job needs.

CCTV in common areas of multi-unit buildings requires the standard disciplines — purpose, signage, retention — and cameras inside a tenant's rented home are effectively indefensible: the dwelling is the tenant's private sphere. Smart doorbells and cameras that a landlord retains access to after letting are a growing complaint category.

Arrears, disputes and the RTB

Arrears generate the most sensitive processing a landlord does: payment histories, correspondence, sometimes welfare and health context volunteered by tenants. Record facts accurately and dispassionately — the file may be read aloud at an RTB hearing or arrive in an access request. Disclosures to third parties (agents, solicitors, the RTB itself) travel on legitimate gateways; disclosures to the tenant's employer, family or new landlord out of frustration are infringements that convert a rent dispute into a data protection liability.

Access requests and retention after the tenancy

Tenants and former tenants can make access requests, and they typically arrive alongside a deposit dispute or RTB case. The response covers the file you hold about them — with other parties' data (a co-tenant, a complaining neighbour) balanced and redacted as needed — on the standard one-month clock.

After a tenancy ends, retain what genuinely serves live purposes: records supporting tax filings for the statutory periods (your accountant's domain), documents relevant to an open dispute, and the tenancy's essential record for a defined period against later claims. Indefinite retention of everything about every former tenant is the pattern to break — set a schedule and run it.

Frequently asked questions

Can I ask applicants for bank statements and PPS numbers?

Ability-to-pay evidence proportionate to the letting is legitimate, and the PPS number is collected for RTB registration from the tenant you proceed with. Collecting everything from every applicant, or warehousing unsuccessful applications, is where landlords overreach.

How long can I keep a former tenant's data?

To a schedule you can justify: tax-supporting records for the statutory retention periods, dispute-relevant documents while the dispute is live, and the core tenancy record for a defined period against later claims — not everything forever.

Can I put a camera in the rented property?

Inside the tenant's dwelling, effectively no — it is their private sphere. Common areas of multi-unit buildings can carry CCTV under the ordinary rules: purpose, signage, proportionate coverage and retention. Retaining remote access to smart devices after letting is a live complaint area.

A former tenant sent me an access request during a deposit dispute. Must I respond?

Yes — the dispute does not suspend the right. Respond within one month with their data, redacting other people's information where the balance requires, and keep the response factual. The file you kept is the response you can give.

Can I warn other landlords about a bad tenant?

Informal blacklisting is high-risk processing with no clear lawful basis and real defamation exposure. Answer reference requests you receive accurately and factually; volunteering warnings around the market is where liability starts.

Talk to a GDPR solicitor

Mary Molloy Solicitors acts for individuals and organisations across Ireland on data protection matters — access requests, breaches, compensation claims, complaints and compliance. All enquiries are handled through our Dublin office.

This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.