Protecting Tenant Data: What a Landlord Holds and How to Secure It

This is general information, not legal advice. Data-security law is federal and state law, and it changes. Use this as a checklist, and ask a lawyer in your state about anything specific.

A landlord with six units can hold more sensitive data than many small businesses: Social Security numbers, credit reports, bank account numbers and copies of driver’s licenses, for every applicant, not only every tenant. Most of it is needed for a few days, during screening. The risk comes from keeping it for years in an inbox, a desk drawer or a laptop without a password.

What you actually hold

Data	Where it usually sits	How long you need it
Social Security numbers	Applications, screening requests	Until screening is done
Credit and screening reports	Email, downloads, printouts	Long enough to decide, and to show why
Bank account and routing numbers	Checks, transfer records, deposit refunds	While payments run
Driver’s license or ID copies	Applications	Until identity is confirmed
Pay stubs and bank statements	Applications	Until income is verified
Guarantor or cosigner details	Guaranty forms	For the length of the lease
Names, rent and balances	Your rent roll and ledgers	For the tax retention period

Two rows in that table, the Social Security numbers and the screening reports, carry most of the risk and most of the law.

The federal rules on screening reports

The Disposal Rule. Under the Fair Credit Reporting Act, the Federal Trade Commission’s Disposal Rule (16 CFR Part 682) says anyone who has consumer report information for a business purpose must take reasonable measures to protect it from unauthorized access or use when disposing of it. The FTC names landlords, including individuals who pull credit reports on prospective tenants. The rule’s examples: burn, pulverize or shred papers so they cannot practicably be read or reconstructed, and destroy or erase electronic media the same way. Deleting a download is a start. A laptop you sell, donate or recycle needs its drive erased or destroyed first.

Adverse action notices. If you deny an application, require a cosigner, ask for a larger deposit or charge more rent because of something in a consumer report, you owe the applicant a notice. It must give the name, address and phone number of the company that supplied the report; say that the company did not make the decision; and tell the applicant of the right to a free copy of the report within 60 days and the right to dispute its accuracy. The law allows an oral notice, but the FTC calls a written one the best practice, and it is your proof. If a credit score played a part, the score and the key factors that hurt it must be disclosed in writing or electronically.

Permissible purpose. You may pull a report only for a housing decision, such as an application or a renewal, and you certify that to the screening company.

State breach-notification laws

All 50 states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notice when personal information is breached, according to the FTC. The details differ. According to the National Conference of State Legislatures, these laws typically define personal information as a name combined with a Social Security number, a driver’s license or state ID number, or an account number, and they often exempt encrypted information. That exemption is the best argument for encryption: a lost laptop with an encrypted drive can be an inconvenience rather than a set of notification letters.

Some states ask more before anything goes wrong. Massachusetts requires every person who owns or licenses personal information about a Massachusetts resident, in connection with providing goods or services, to keep a written information security program (201 CMR 17.03).

Controls that fit a small landlord

The FTC’s guide for businesses sums up data security in five steps: take stock, scale down, lock it, pitch it, plan ahead. For a landlord:

1. Collect less. Check affordability before asking for anything sensitive. An applicant who states $5,200 a month in income for a $1,600 unit clears a three-times-rent screen, at a 30.8% rent-to-income ratio. Ask for a Social Security number only when you are ready to screen, and if your screening company lets applicants enter their own details on its site, use that, so the number never reaches you.
2. Encrypt what you keep. Turn on full-disk encryption and a passcode on the laptop and phone you use for the rentals, and keep screening files in an encrypted folder or account, not loose in email.
3. Lock the paper. Applications and ID copies go in a locked cabinet. Nothing sensitive rides in the car.
4. Keep an access list. Write down who can open each account and file: you, a co-owner, a bookkeeper, a manager. Turn on two-step sign-in everywhere, and change passwords the day someone leaves.
5. Shred on a schedule. Cross-cut shred reports and applications when their time is up. The guide to organizing rental documents sets the periods.
6. Plan ahead. Keep a one-page note of what you hold and where it is, so a loss becomes a list of names, not a guess.

An illustrative timeline: an applicant applies on October 5, 2026, and the screening report arrives on October 7. On October 8 you deny the application because of the report and send the adverse action notice that day. The Fair Housing Act gives an applicant two years to sue, so the file stays in the encrypted folder until October 2028, then gets deleted and shredded on purpose. For the applicant you approve, the Social Security number has done its job once screening is complete; the lease file needs the lease, not the number.

If data is lost or stolen

Say your car is broken into on a Saturday, and a folder with four applications and the laptop you use for the rentals are taken. The FTC’s breach-response guide for businesses points to three jobs: secure, fix, notify.

1. Report it to the police and note the report number.
2. Change passwords for every account the laptop was signed in to, and sign it out remotely where you can.
3. Work out exactly what was taken: whose data, which kinds, and whether the laptop was encrypted.
4. Read the breach law in your state and in any state where an affected person lives, for who must be told, how and how fast. If you are unsure, this is the moment to call a lawyer.
5. Tell the people affected plainly: what happened, what was taken, what you are doing, and what they can do. The FTC suggests pointing them to a free fraud alert or a credit freeze, and to IdentityTheft.gov for a recovery plan.

Then close the gap that let it happen. Look for the ordinary ones first: paper left in a car, a laptop with no passcode, an old inbox full of attachments. Your security deposit records and receipts stay on file for years; Social Security numbers and screening reports should leave as soon as their job is done.