You have four applicants for the same flat. They all seem nice. One of them is getting the keys, and you would rather not choose on gut feeling.

Then the question comes: what are you actually allowed to ask about, what may you check, and how long may you keep what you receive?

It is worth having clear. Not only because the rules apply, but because a structured assessment is easier to defend when you say no to three out of four.

In short

  • The data protection rules are built on the principle that you may only process what is necessary for a legitimate purpose. In a tenant assessment, the purpose is to assess whether the applicant can pay the rent.
  • Ask at the right moment. Financial information belongs late in the process, when the applicant is genuinely in the running for the home.
  • You are the data controller for the information you receive. That includes what sits in your inbox.
  • You may not take into account protected characteristics, for example ethnicity, religion, disability or family circumstances.
  • A score or a recommendation is a basis for a decision. You make the decision yourself, and you have to be able to explain it.
  • Keep it only as long as you need it, and delete the rest.

How to decide what you may ask about

There is no Danish list of which questions a landlord may ask. The rule is a different one, and it is more useful in practice: there has to be a lawful basis and a legitimate purpose, and you may only process what is necessary for that particular purpose.

That makes it a question of justification rather than of permission. You have to be able to explain why you are asking for each piece of information in the specific tenancy.

Test each piece of information against three questions: What am I going to use it for? Could I make the same decision without it? How long do I need to keep it?

If you cannot answer the first one clearly, do not ask for the information.

How much documentation it takes depends on the tenancy and on how far the applicant is in the process. If you are in doubt about a particular piece of information, the question is not whether it is permitted, but whether you can explain why you need it.

One thing is concrete: if you ask for a CPR number, that requires explicit consent.

What you do not need, you should not ask for. Bank statements with every single transaction, information about family circumstances, health, or what the applicant spends money on do not belong in a tenant assessment.

Ask at the right moment

There is a difference between an open viewing with twenty people and an applicant you are about to sign a contract with.

Use the same short basis for everyone at the start. Only ask for the financial documentation once the applicant is genuinely in the running for the home. It means less data to look after, it is more respectful towards the applicants who do not get the home, and it is easier to defend.

You are the data controller, including when it sits in your inbox

The moment you receive payslips and personal data, you are responsible for them. You need a lawful basis for processing them, you have to be able to tell the applicant what you are using them for, and you have to store them securely and delete them again.

Two things surprise most people:

Consent is not automatically a strong basis in a rental situation. One party has the home, the other would like to have it, which makes the consent hard to call freely given. That is why it matters that the basis is chosen deliberately and written down.

An ordinary inbox is not a good place to keep other people's finances. That is not a formal prohibition, it is a practical risk: it stays there, it gets forwarded, and it never gets deleted.

A third party can take part of that exposure off you, because the information is then handled in one place with access control and a fixed deletion. The responsibility as data controller stays with you, and anyone who promises you otherwise is promising too much.

What you may not take into account

You may choose the applicant you judge best able to pay and look after the home.

Discrimination on grounds including ethnic origin, religion, disability, sexual orientation, sex, age and pregnancy is regulated in Danish law. The rules are in the Act on the Prohibition of Discrimination, linked under Sources.

That applies when the criterion is wrapped in something else too, for example a requirement of permanent full-time employment that in reality sorts by something other than ability to pay.

The practical safeguard is the same as the good process: apply the same criteria to all applicants, write the criteria down in advance, and note briefly why you chose as you did.

A score does not decide the case

If you get a result, an assessment or a score on an applicant, that is a basis for a decision and not a decision.

The GDPR sets a limit on fully automated decisions with significant effect on the individual, and the Danish Data Protection Agency has published guidance on automated decisions and profiling. Under those rules there has to be a human involved, the applicant has to be able to learn the main reasons, and there has to be somewhere to object.

In practice that means three things for you:

Read what sits behind the result, instead of looking only at the number.

Write your own reasoning down, briefly and factually.

If the applicant asks why it was a no, you have to be able to answer without guessing.

What the process can look like

Write your criteria down before you advertise. What ability to pay do you require, and what documentation do you ask for?

Use the same short basis for all applicants in the first round.

Select the applicants in the running, and only then ask for the financial documentation.

Carry out the assessment in one place with access control, and avoid collecting documents in email.

Make the decision, and write down briefly what it is based on.

Tell the other applicants, and delete their information.

Keep what belongs to the tenancy together with the contract, and delete the rest.

How Keyhole makes it easier

Keyhole Tenant Screening is made for exactly that decision. You send the applicant a link, the applicant provides their own information, and you get an overall assessment of ability to pay back.

Three things are worth highlighting:

You get a recommendation, not raw financial data. The applicant's details stay with us, and you get what you need to make the decision.

The result is available for seven days and is then deleted automatically. It is set up that way because the assessment belongs to one specific letting and not to an archive.

The decision is still yours. The assessment is a basis, it is a snapshot, and it is not a guarantee of future payment.

It removes a concrete exposure, namely strangers' payslips in your inbox, and it supports a process you can stand behind. Your responsibility as data controller for the tenancy still sits with you.

Frequently asked questions

May I ask for payslips?

Yes, when it is necessary to assess ability to pay in the specific tenancy, and when you ask at the right moment.

May I ask for bank statements?

Be careful. A full bank statement contains far more than you need. Use a solution that gives you the conclusion rather than the material.

How long may I keep the information?

As long as you need it for the purpose. Information about applicants who did not get the home has to be deleted once the choice is made.

May I check the applicant on social media?

You may not base the decision on protected characteristics, and a search online rarely says anything about ability to pay. Stick to criteria you can defend.

Does the applicant have to be told about the assessment?

Yes. The applicant has to know what is being processed and why, and has to be able to learn the main reasons for a rejection.

Is an assessment a guarantee that the tenant will pay?

No. It is a basis for a decision at a particular moment.

Try Tenant Screening

See what you get back, what the applicant has to do, and how the result is deleted after seven days.

Book a conversation

Talk to Daniel about setting up a consistent process across your tenancies.

Sources

  • The GDPR and the Danish Data Protection Act, Danish Data Protection Agency guidance on processing personal data
  • Danish Data Protection Agency, guidance on automated decisions and profiling
  • The Act on the Prohibition of Discrimination, retsinformation.dk
  • Keyhole Tenant Screening, product terms