How do landlords have to dispose of old tenant applications and screening reports?
Shred, burn or pulverize paper and erase or destroy electronic files so they cannot practicably be read or reconstructed. The FTC's Disposal Rule requires that for anything that is or comes from a consumer report, such as a tenant screening report, and states like California, Florida, Massachusetts and Washington apply similar rules to other personal records, with fines or lawsuits for getting it wrong.
The federal rule for screening reports
The FTC's Disposal Rule applies to anyone under the FTC's jurisdiction who keeps consumer information for a business purpose. Consumer information means a consumer report or any record derived from one, in paper or electronic form. If you pulled a credit or background report on an applicant, that report, and your notes copied from it, are consumer information (16 CFR part 682).
The standard is reasonable measures to protect against unauthorized access when you dispose of it. The rule gives examples: policies that require burning, pulverizing or shredding papers, policies that require destroying or erasing electronic media, and hiring a document destruction company after checking it out, for example by reading an independent audit, calling references, or requiring certification from a trade association. Disposal also includes selling, donating or handing over a computer or drive that held the information.
State rules that reach every tenant file
State laws go beyond screening reports to applications, leases with Social Security numbers, bank details and ID copies.
| State | What it covers | How to dispose | If you get it wrong |
|---|---|---|---|
| California (Civil Code 1798.81) | Customer records with personal information; a customer includes someone leasing from you | Shred, erase, or modify the records to make them unreadable | See the rest of the customer records title, Civil Code 1798.80 and following |
| Florida (501.171(8)) | Customer records with personal information | Shred, erase, or modify to make them unreadable or undecipherable | Treated as an unfair or deceptive trade practice |
| Massachusetts (chapter 93I, section 2) | Records with personal information | Paper redacted, burned, pulverized or shredded; electronic media destroyed or erased | Civil fine up to $100 per person affected, up to $50,000 per instance |
| Washington (RCW 19.215.020) | Personal financial and health information and government ID numbers | Take all reasonable steps to destroy | Injured person can sue: at least $200 if negligent, $600 if willful, plus fees |
Read on 2026-10-30: California 1798.81 and its definitions, Florida 501.171, Massachusetts 93I section 2, Washington 19.215.020. Many other states have similar laws; check yours.
What a bad disposal can cost
Example a made-up owner of a 30 unit building in Massachusetts cleans out a storage closet and puts a box of 120 old rental applications, unshredded, in the dumpster. At up to $100 per person affected, the possible fine is 120 times $100, or $12,000, which is under the $50,000 cap for one instance.
Example a made-up Washington owner leaves old applications with bank account numbers in an unlocked recycling bin, and three former applicants sue. If a court finds negligence and none can show larger damages, the minimum is $200 each, or $600, plus their costs and attorneys' fees, which can easily be larger than the penalty.
A twice-a-year purge routine
- Decide how long you keep each kind of record before you throw anything away. Tax records, leases in dispute and anything under a legal hold stay. Ask your attorney for the periods that apply in your state.
- Twice a year, pull everything past its date: denied applications, old screening reports, ID copies, and files of tenants who left long ago.
- Shred paper with a cross-cut shredder, or use a destruction company that gives you a certificate listing what it destroyed.
- Delete the matching files from email, downloads, scanners and shared drives, and empty the trash folders.
- Before you sell, donate or recycle a computer, phone, printer or scanner that stored tenant files, erase it so the data cannot be recovered, or have the drive destroyed.
- Write down the date and what was destroyed. That log is your evidence of reasonable measures.
The cheapest record to dispose of is one you never collected. Keep only the last four digits of a Social Security number where you can, and do not photocopy IDs you do not need. If a disposal goes wrong and records leave your control, the notice rules in our data breach guide may apply.
Fewer papers to shred with DoorKeeping
DoorKeeping keeps leases and tenant documents in one place behind two-factor sign-in, so there is no filing cabinet or download folder of copies to clean out later. Leases are signed electronically, and rent goes straight to your own bank, so DoorKeeping never holds tenants' card numbers or bank logins. It costs $2 per unit per month, with no fees for owners or tenants, and it does not give legal advice on retention periods.
Sources
- 16 CFR part 682, Disposal of Consumer Report Information and Records, read Oct 30, 2026
- California Civil Code section 1798.81, read Oct 30, 2026
- California Civil Code section 1798.80 (definitions), read Oct 30, 2026
- Florida Statutes 501.171, Security of confidential personal information, read Oct 30, 2026
- Massachusetts General Laws chapter 93I, section 2, read Oct 30, 2026
- Washington RCW 19.215.020, Destruction of information, read Oct 30, 2026
Questions
- Can I throw old rental applications in the trash?
- Not intact. Screening reports fall under the FTC Disposal Rule, and many states require personal records to be shredded, burned or erased so they cannot be read or reconstructed.
- Does the FTC Disposal Rule apply to small landlords?
- It applies to anyone under FTC jurisdiction who keeps consumer report information for a business purpose. A landlord who ordered a screening report on an applicant holds that kind of information.
- Is it enough to delete tenant files from my computer?
- Deleting is a start, but the FTC rule's example is erasing or destroying electronic media so the information cannot practicably be read or reconstructed, including before you sell or donate the device.