GDPR in rental: what every landlord needs to know

A tenancy agreement contains the tenant's name, address, national ID number, and passport number — these are personal and sensitive data under GDPR (EU Regulation 2016/679).

As a landlord you are required to: - Obtain written consent for processing personal data before signing the agreement. - Record the date and version of consent. - Anonymise or delete personal data within 30 days of the tenancy ending. - Protect data from unauthorised access — via encryption and access controls.

SmartRent automatically encrypts the national ID and passport number (AES-256-GCM), records GDPR consent with a timestamp, and anonymises the tenant after the tenancy ends according to your configured retention policy.