What does a landlord have to do after a data breach exposes tenant information?
Contain it, find out what was exposed, and if the data includes things like Social Security numbers or bank details, notify the people affected under your state's breach law. Washington, Florida and New York each require notice to affected residents within 30 days of discovery, and each has a threshold for telling state officials.
What a small landlord holds that thieves want
A file cabinet or inbox for a 30 unit building often holds more sensitive data than owners realize: rental applications with Social Security numbers and dates of birth, copies of driver's licenses, pay stubs and bank statements, and bank details for deposit refunds. A breach does not need a hacker. A stolen laptop, an email account taken over by a phishing link, or a shared folder left open to anyone with the link can all count.
The first steps, in order
The FTC's guide for businesses sets out a sequence that fits a one-person landlord as well as a company (FTC, Data Breach Response).
- Contain it: change passwords on the affected accounts, sign out other sessions, turn on two-factor sign-in, and take a compromised device offline without wiping it.
- Preserve evidence: keep emails, logs and the device as they are.
- Call your local police department and report it, and coordinate the timing of notices so they do not disrupt an investigation.
- Work out exactly what was exposed and whose: list each person and each kind of data.
- Remove anything posted publicly and close shared links.
- Decide who must be told, using your state's law and the residents' states.
Notice deadlines in three states
| State | Notice to residents | Notice to officials | Credit bureaus |
|---|---|---|---|
| Washington | No more than 30 calendar days after discovery | Attorney general within 30 days if more than 500 Washington residents | Notice must include their toll-free numbers and addresses when personal information was exposed |
| Florida | No later than 30 days after a breach is determined or suspected | Department of Legal Affairs within 30 days if 500 or more Florida individuals | Notify them if more than 1,000 individuals at one time |
| New York | Without unreasonable delay and no later than 30 days after discovery | Attorney general, Department of State and State Police | Notify them if more than 5,000 New York residents at one time |
Sources: RCW 19.255.010, Florida Statutes 501.171, New York General Business Law 899-aa. Each law allows delay when law enforcement asks for it. The FTC notes that every state has a breach notice law, so if your tenants or applicants live elsewhere, check that state's law and talk to an attorney.
Florida's law also requires reasonable measures to protect personal data in electronic form and reasonable steps to dispose of customer records, such as shredding or erasing them, once they are no longer kept.
What the notice letter says
Washington requires plain language and lists the contents; the FTC suggests similar points. A notice usually covers:
- Your name or the LLC's name and how to contact you.
- What happened, when it happened and when you found out, if known.
- Which kinds of information were involved, such as Social Security number or bank account.
- What you have done since: passwords changed, police report, any credit monitoring you offer.
- What the person can do: a fraud alert or credit freeze, and IdentityTheft.gov for a recovery plan.
- How you will send updates, so they can spot fake follow-ups.
Example a made-up owner's email is taken over on March 3 and he discovers it on March 10. The inbox held 42 rental applications with Social Security numbers, 38 from Washington residents. Thirty calendar days from discovery is April 9, so letters to the 38 must go out by then. With fewer than 500 Washington residents affected, the attorney general notice is not required under that section, but he checks the laws of the states where the other 4 applicants live.
Holding less makes the next one smaller
- Keep applications only as long as you must, then shred paper and delete files.
- Never email Social Security numbers or full bank details; use a portal or have the screening company handle them.
- Turn on two-factor sign-in for email, bank and every app that touches tenant data.
- Keep tenant files in one system you control rather than scattered across inboxes and phones.
How DoorKeeping limits exposure
DoorKeeping never holds rent and sends a payment only when you approve it: tenants pay your own bank, so tenants never give DoorKeeping a card number or bank login. It supports two-factor sign-in, and tenant documents live in one place instead of email threads. Read how DoorKeeping handles security. It costs $2 per unit per month and gives no legal advice, so breach notices are a question for your attorney.
Sources
- FTC, Data Breach Response: A Guide for Business, read Oct 30, 2026
- Washington RCW 19.255.010, Disclosure, notice, read Oct 30, 2026
- Florida Statutes 501.171, Security of confidential personal information, read Oct 30, 2026
- New York General Business Law 899-aa, read Oct 30, 2026
Questions
- Does a small landlord have to report a data breach?
- Often yes. State breach laws generally apply to any person or business that owns personal information about residents, not only large companies. Check the law of each affected person's state.
- How long do I have to notify tenants of a breach?
- Washington, Florida and New York each set a 30-day limit after discovery, with delays allowed when law enforcement asks. Other states differ.
- Is a stolen laptop with rental applications a breach?
- It can be, if the files held personal information such as Social Security numbers and were not protected. Work out what was on it and check your state's definition with an attorney.