Deleting Applicant Data: What Landlords Must Legally Do After a Rejection

Landlords can't keep the documents of rejected apartment applicants — SCHUFA reports and tenant self-disclosure forms included — indefinitely. Under Article 17(1)(a) GDPR, personal data has to be deleted once the purpose for collecting it no longer applies. In practice, that usually means deletion after roughly six months, since rejected applicants can still raise discrimination claims under Section 21 of the General Equal Treatment Act (AGG) within that window.

Why landlords have a deletion obligation at all

The moment a landlord accepts application documents from prospective tenants, they become a data controller under the GDPR — regardless of whether they rent out one apartment or a hundred. Processing that data during the selection process is covered by a legitimate interest in choosing a tenant. Once the apartment is let, that purpose no longer applies to every applicant who wasn't chosen, and their data generally has to be deleted.

The practical retention window: six months as a benchmark

Some risk remains even after a rejection: rejected applicants can raise written claims of possible discrimination in the tenant-selection process under Section 21 AGG within two months. To be able to prove or disprove such a claim if it comes up, keeping the documents for about six months after the rejection is generally considered defensible in practice. Deleting everything immediately after the rejection would leave the landlord unable to defend themselves in a dispute, while keeping the documents indefinitely would breach the storage-limitation principle under Article 5 GDPR.

When a longer legal dispute is likely

In individual cases, a longer retention period of up to three years can be justified if Section 21(3) AGG, combined with the general limitation rules for tort claims, points to an extended litigation risk — for example, if a rejected applicant has already announced they'll involve a lawyer. This extended period is the exception, not the rule, and should be documented so the longer retention can be justified if it's ever questioned.

What happens to rejected applicants' SCHUFA reports

A rejected applicant's submitted SCHUFA-BonitätsAuskunft follows the same deletion logic as the rest of their application documents. Landlords shouldn't keep it any longer than necessary, or pass it on to third parties, since it was collected solely for that specific rental decision. Digital copies sitting in email inboxes are often overlooked when it comes to deletion, which is why setting a fixed reminder — say, six months after each rejection — is worth putting in the calendar.

One exception: consent for future offers

Landlords who want to keep promising applicants in mind for future vacancies can store their contact details beyond the standard deletion window, but only if the applicant has explicitly consented to that further storage. Without that separate consent, the original selection process alone isn't a sufficient legal basis for holding onto the data longer. For a full picture of what to prepare as an applicant in the first place, see our guide to essential documents for a rental application.

Conclusion

Rejected applicants' documents aren't archive material. Deleting them after about six months balances the GDPR's deletion requirement with a landlord's legitimate interest in being able to defend against possible AGG claims.

Frequently Asked Questions

How long can landlords keep applicant data after a rejection?

About six months is the usual benchmark, based on the window for possible discrimination claims under Section 21 AGG.

Do I have to delete applicant data immediately after rejecting someone?

No, immediate deletion would leave the landlord exposed in a later dispute. Keeping the documents for a few months is considered reasonable.

Can a longer retention period than six months be justified?

In individual cases, yes — for example, if legal action has already been announced, up to three years may be justified. That's the exception, not the norm.