Tenant Screening Data Security: What Applicant Information Should Landlords Protect?

Tenant screening requires landlords and property managers to collect some of the most sensitive information a renter may ever share outside a bank or employer.

A rental application can contain a full legal name, date of birth, Social Security number, current and prior addresses, income records, employment information, bank statements and credit or background reports. That information can help determine whether an applicant meets rental criteria, but it also creates a responsibility to protect the data from unnecessary exposure, misuse or insecure disposal.

For East Bay rental property owners, applicant data security should now be treated as part of the tenant-screening process itself.

What Applicant Information Is Most Sensitive?

A rental application can contain far more than basic contact information.

The FTC notes that tenant background screening may involve information such as:

• Full name
• Social Security number
• Date of birth
• Current and former addresses
• Work and income history
• Credit-account information
• Rental payment history
• Eviction records
• Criminal-history information
• Bankruptcy or lawsuit records

Some of this data is especially sensitive because it can be used for identity theft or financial fraud if it falls into the wrong hands.

Owners should pay particular attention to:

The FTC has specifically warned that tenant-screening and consumer-report systems may contain names, Social Security numbers, birth dates, bank and credit-card information, credit histories and other personal information attractive to identity thieves.

That creates a simple principle:

If information is sensitive enough to help qualify an applicant, it is usually sensitive enough to deserve deliberate protection.

Owner takeaway: Tenant screening is not only about getting accurate information. It is also about controlling who can access that information and what happens to it after the decision is made.

Should Landlords Collect Less Applicant Data?

Often, yes.

One of the easiest ways to reduce privacy risk is to avoid collecting information that is not actually needed.

A landlord may need enough information to:

• Confirm identity
• Evaluate income
• Verify employment
• Review rental history
• Obtain a consumer report
• Apply lawful screening criteria

But collecting extra copies of IDs, full bank histories or unrelated personal documents “just in case” can create unnecessary exposure.

The question should be:

What information do we actually need to make this screening decision?

Not:

What else can we collect?

This is particularly important with bank statements.

An owner may need to verify income, but that does not necessarily mean every transaction in an applicant’s account is relevant.

Likewise, a landlord may need identity information to obtain a screening report, but that does not mean copies of sensitive documents should be circulated among multiple people by ordinary email.

A more disciplined process separates:

Information needed for screening

from

information that is merely available.

Best Property’s tenant screening service can help centralize applicant verification within a defined leasing workflow rather than leaving sensitive documents scattered across email, phones and personal devices.

How Should Landlords Store Rental Application Information?

There is no single storage system that fits every owner.

But the objective is consistent:

Sensitive applicant information should not be casually accessible.

Owners should avoid practices such as:

• Leaving printed applications on an open desk
• Saving Social Security numbers in ordinary notes apps
• Forwarding credit reports unnecessarily
• Storing applicant documents indefinitely on personal laptops
• Sharing bank statements by unsecured group email
• Allowing contractors or unrelated employees to access screening records
• Keeping paper applications in unlocked filing cabinets

A stronger process limits access to the people who genuinely need the information for screening or leasing.

For electronic records, that can include:

• Secure property-management or screening platforms
• Strong unique passwords
• Multifactor authentication where available
• Restricted user permissions
• Encrypted or protected file storage
• Controlled document sharing
• Secure backups
• Prompt removal of unnecessary downloaded copies

The FTC’s general data-security resources emphasize safeguarding sensitive information such as Social Security numbers, credit reports and account information.

For small landlords, this matters just as much as it does for a large property-management company.

A single rental application can contain enough information to create serious consequences for an applicant if it is mishandled.

What Do Landlords Need to Know About Credit Reports and Screening Reports?

Credit reports and tenant-screening reports receive additional protection under federal law.

The Fair Credit Reporting Act applies when landlords use consumer reports to make housing decisions.

The FTC explains that a consumer report used for tenant screening can include:

• Credit reports
• Rental-history reports
• Criminal-history reports
• Combined tenant-screening reports
• Risk scores or recommendations
• Reference-checking reports

Landlords can obtain a consumer report only for a permissible purpose, such as evaluating a rental application or lease renewal. They also must certify to the reporting company that the report will be used only for housing purposes.

That means a credit report obtained for an applicant should not later be used casually for an unrelated purpose.

Consumer reports also should not be broadly distributed.

Access should be limited to people who need the information for the rental decision.

If the report contributes to an adverse decision, such as rejecting an applicant, requiring a co-signer or requiring different financial terms, the landlord may need to provide an adverse-action notice explaining the applicant’s rights.

The FTC’s July 2026 enforcement action against RentGrow is another reminder of how seriously consumer-report accuracy and handling are treated. The tenant-screening company agreed to pay $2.25 million to settle allegations involving failures to use reasonable procedures to ensure report accuracy.

Owner takeaway: A screening report is not just another attachment. It is regulated consumer information that should be accessed, used and disposed of carefully.

How Long Should Landlords Keep Applicant Information?

There is no single universal retention period that applies to every category of rental record in every jurisdiction.

Owners should therefore avoid inventing an arbitrary “keep everything forever” policy.

There are competing concerns.

Records can be important for:

• Documenting the screening process
• Responding to disputes
• Showing how criteria were applied
• Supporting fair housing compliance
• Meeting legal or business recordkeeping needs

But keeping unnecessary sensitive information indefinitely increases privacy and security exposure.

That suggests a better approach:

Have a written retention policy.

The policy can distinguish between records that need to be retained and sensitive documents that can be securely deleted after their legitimate purpose has ended.

Owners should obtain legal guidance for property-specific retention requirements, particularly when state or local laws may apply.

For consumer reports specifically, federal rules make one point very clear:

When you are finished with them, disposal must be secure.

How Should Landlords Dispose of Credit Reports and Applicant Records?

The FTC’s Disposal Rule applies to businesses and individuals that use consumer reports for business purposes, including landlords.

The rule requires reasonable measures to prevent unauthorized access to or use of consumer-report information during disposal.

For paper records, that can include:

• Shredding
• Pulverizing
• Burning documents so they cannot be reconstructed

For electronic information, the FTC says files or media should be destroyed or erased so the information cannot be read or reconstructed.

Simply putting an old credit report in the trash is not appropriate.

Neither is dragging a sensitive PDF into a computer’s recycle bin and assuming the information is permanently gone.

Owners should also think beyond formal credit reports.

The FTC encourages businesses disposing of records containing consumer personal or financial information to use similarly protective disposal practices, even when the information does not fall directly under the Disposal Rule.

That can include:

• Old rental applications
• Pay stubs
• Bank statements
• ID copies
• Tax records
• Employment verification files

A disciplined screening system should therefore have a beginning and an end:

Collect securely. Use only as needed. Store carefully. Dispose securely.

Who Should Have Access to Tenant Screening Data?

The answer should generally be:

As few people as reasonably necessary.

A common security problem is not sophisticated hacking.

It is oversharing.

An application might be forwarded to:

• An owner
• An assistant
• A leasing agent
• A property manager
• A spouse or business partner
• A contractor helping with administrative work

Soon, several copies exist across email accounts, phones and computers.

That makes it much harder to control the information.

A better process uses role-based access.

The person handling screening may need full access.

Someone scheduling a showing probably does not need an applicant’s Social Security number or credit report.

A maintenance vendor should have no reason to see an applicant’s financial documents.

Separating responsibilities reduces unnecessary exposure.

Professional property-management systems can also help because documents and permissions can be centralized instead of transferred manually from person to person.

Best Property’s East Bay leasing and tenant placement guide explains why applications, screening and leasing should operate as one defined workflow rather than disconnected administrative tasks.

What Should East Bay Landlords Do Now?

Applicant data security does not require a complicated cybersecurity department.

It requires better habits.

A practical approach includes:

Collect only what you need

Avoid unnecessary sensitive documents.

Use secure screening systems

Prefer established platforms over scattered email attachments when possible.

Restrict access

Only people involved in the screening decision should have access to sensitive information.

Protect accounts

Use strong passwords and multifactor authentication where available.

Avoid unnecessary downloads

Every extra local copy of a bank statement or credit report creates another point of exposure.

Document your process

Know who receives applicant information, how it is stored and when it is deleted.

Dispose of information securely

Consumer-report information must be disposed of appropriately when it is no longer needed.

Review your vendors

If a third-party screening provider handles applicant information, understand what information the service collects and how it is protected.

Data security is becoming even more important as tenant screening becomes more digital.

The same technology that makes applications faster also makes it easier to create unnecessary copies of sensitive information.

The goal should be simple:

Use applicant information only for legitimate screening purposes and protect it throughout its lifecycle.

Related Tenant Screening Resources

• Tenant Screening for Rental Property Owners
• Tenant Background Checks
• East Bay Leasing and Tenant Placement Guide
• Residential Leasing Services

Frequently Asked Questions About Rental Application Data Security

What personal information should landlords protect on a rental application?

Landlords should carefully protect any information that could expose an applicant to privacy, identity-theft or financial risk. That includes Social Security numbers, dates of birth, driver’s-license information, prior addresses, pay stubs, bank statements, tax records, employment information and credit or tenant-screening reports. The FTC notes that tenant background checks may contain extensive identity, financial, rental and credit information. Owners should collect only information reasonably necessary for legitimate screening and should restrict access to people who actually need it.

Can landlords keep copies of applicants’ credit reports?

Landlords may obtain consumer reports for legitimate housing purposes under the Fair Credit Reporting Act, but those reports should be handled carefully. They should not be used for unrelated purposes or distributed unnecessarily. The FTC also requires secure disposal of consumer-report information when it is no longer needed. Owners should establish a retention policy based on applicable legal and business requirements and make sure paper and electronic copies are destroyed in a way that prevents unauthorized reconstruction or access.

Is it safe for applicants to email bank statements and pay stubs?

Ordinary email can create additional copies of sensitive documents across inboxes, devices and backups. When possible, a secure application or tenant-screening platform can provide better control over who can access applicant files. If documents must be transferred electronically, owners should limit recipients, avoid unnecessary forwarding and delete extra copies when they are no longer required. The objective is not necessarily to ban email entirely, but to reduce uncontrolled distribution of documents containing income, account or identity information.

How should landlords dispose of old rental applications?

Sensitive records should not simply be placed in ordinary trash or left on an old computer. The FTC’s Disposal Rule requires landlords and other users of consumer reports to take reasonable measures when disposing of consumer-report information. Paper records can be shredded or otherwise destroyed so they cannot be reconstructed, while electronic records should be erased or destroyed so they cannot be read or recovered. Similar precautions are sensible for other rental application records containing personal or financial information.

Who should have access to an applicant’s screening information?

Access should generally be limited to people who genuinely need the information to process or evaluate the rental application. A leasing professional evaluating income may need sensitive records, while a showing coordinator or maintenance vendor generally would not. Restricting access reduces accidental disclosure and limits the number of copies created. Owners using property-management or screening systems should review account permissions, use strong authentication and avoid shared logins where possible. A clear internal process also makes it easier to know where applicant information is stored and when it should be removed.

Best Property Management Bay Area Offices

Brentwood Office 200 Sand Creek Rd., Suite D, Brentwood, CA 94513 925-392-2411 ronventura@bestproperty4u.com

Fremont Office 40069 Mission Blvd., Fremont, CA 94539 510-770-0824 dustinventura@bestproperty4u.com

Livermore Office 1985 First Street, Suite 209, Livermore, CA 94550 925-292-1785 robertventura@bestproperty4u.com

Tracy Office 672 West 11th Street, Suite 208, Tracy, CA 95376 209-340-2500 brendanreese@bestproperty4u.com

This article is provided for general informational purposes only and is not legal, privacy, cybersecurity, fair housing or tenant-screening compliance advice. Data-security obligations, record-retention requirements and consumer-reporting laws can vary. Rental property owners should verify current requirements and consult qualified professionals when appropriate.