How can a landlord reduce the tenant data they hold?
List every place tenant data lives, decide what you truly need for each tenant, delete or lock down the rest on a schedule, and collect less at the start. Data you do not hold cannot be stolen, subpoenaed by mistake or exposed in a breach. The FTC's guide for businesses gives a simple order: take stock, scale down, lock it, dispose of what you do not need and plan ahead.
Step one: find where it lives
Tenant data is a liability that grows quietly. Every application you accept adds a file, a few photos and some emails, and nobody deletes them. After ten years a small landlord can hold hundreds of strangers' personal details, none of which help run the buildings today. A short yearly cleanup keeps the pile from growing.
Most landlords are surprised by how many places hold tenant data. Check your email, the phone camera roll, the downloads folder, a shared drive, old laptops, paper files in a car or garage, the screening site, the rent portal, the accounting file and text threads. Write each place on a list with what it holds and who can reach it.
The FTC's guide for businesses starts with this same step: know what personal information you have, where it is and who has access.
Step two: decide what you need
| Data | Why you may need it | Handling |
|---|---|---|
| Signed lease and addenda | Proof of terms | Keep for the period your state and tax rules require |
| Ledger and notices | Rent history, disputes | Keep, with the lease |
| Application and screening report | Decision record | Keep for the shortest period you rely on, then destroy |
| ID image | One-time check | Delete after verifying, if your rules allow |
| Full SSN | Screening only | Avoid storing. Keep the last four digits |
| Bank account details | Rent payments | Let the payment provider hold them |
Retention rules differ by state and by document, and tax records have their own periods, so use the longer of the rules that apply. Our post on keeping rental applications covers the usual ranges.
Step three: lock down what stays
- Move files from email and phones into one folder with sign-in and two-factor protection.
- Use roles, so each helper sees only what their job needs.
- Encrypt laptops and phones, and use a screen passcode.
- Keep paper in a locked cabinet, with a short list of key holders.
Step four: dispose of it properly
Do not forget the places that copy files without telling you: phone and computer backups, shared drives synced to home computers, and email attachments that sit in the sent folder. Search for a tenant's name once after you delete their folder, and clear what turns up. If a legal hold or a dispute is pending, keep the records until it ends.
Set a calendar reminder each year to review files for tenants who moved out beyond the retention period. Shred paper, empty the trash and downloads, and delete from backups when you can. FTC guidance on disposal of consumer report information says to destroy it in a way that cannot be rebuilt, so shred or burn paper and wipe electronic files. Keep a short list of what you destroyed and when.
Step five: collect less next time
Ask for the least that does the job. Let the screening company hold the full SSN and report. Ask applicants to use a secure upload link instead of emailing a photo of an ID. Use the same checklist for every applicant so you do not collect extra data for some of them, which also helps you treat applicants equally.
DoorKeeping limits what each role can see, so an accountant or a viewer reads records without changing them, and holding less data in the first place is the simplest way to reduce what a leak could expose. DoorKeeping never holds your money and gives no legal advice about retention periods.
Sources
- FTC, Protecting Personal Information: A Guide for Business, read Oct 30, 2026
- FTC, Cybersecurity for Small Business, read Oct 30, 2026
- IRS, Publication 583, Starting a Business and Keeping Records, read Oct 30, 2026
Questions
- Can I delete tenant records right when a tenant moves out?
- Not usually. Keep the lease, ledger and notices for your state's and the IRS's periods, then delete.
- Should I keep copies of tenant IDs?
- Often not. Verify, record that you did, and delete the image unless a rule requires it.
- Where is tenant data most often forgotten?
- Email attachments, phone photos and the downloads folder.