GDPR for Landlords: What You Can (and Can’t) Keep on a Rejected Applicant

If you reject a rental applicant in Ireland in 2026, what you do with their data over the following months is a GDPR question. The applicant has access rights, erasure rights, rectification rights and rights to object to processing. They can ask you what you hold, why, and how long you intend to keep it. They can ask you to delete it.

Most landlords and letting agents we audit have no policy on this. The rejected applicant’s email, payslips, ID copy and reference details sit in an Outlook folder until someone clears it manually, which is to say never. That is not a grey area. It is a documented GDPR breach the moment a Data Protection Commission complaint is filed.

This piece is the practical answer to ‘what do I do with rejected applicant data’, written for landlords, letting agents and PMCs. It is not legal advice. It is the operational standard that keeps you out of the easy DPC complaints.

What rights the applicant has

Under the GDPR, every applicant whose data you process has rights of: access (give me a copy of what you hold), rectification (correct it), erasure (delete it), portability (give it to me in a machine-readable format), restriction (stop processing it pending resolution), and objection (stop processing on legitimate-interest grounds).

These rights apply equally to successful and unsuccessful applicants. The lawful basis for processing the unsuccessful applicant’s data shifts at the moment of rejection: from ‘necessary for the performance of a contract’ to ‘legitimate interests’ (defending against discrimination claims) or consent.

What you can defensibly keep

The defensible position is that you keep enough information to demonstrate, if challenged, that the rejection was on objectively non-discriminatory grounds. That is, in practice:

• The decision (rejected, not shortlisted, etc.)
• The reason (e.g. income below stated threshold, references not received within deadline)
• A summary of the evidence (e.g. ‘verified income EUR 28,000 against stated threshold EUR 35,000’)
• The date of the decision and the staff member who made it

You do not need to keep the raw payslips, the bank statements, or the personal photograph. Once the decision is made and recorded with reasoning, the underlying evidence can be deleted.

The retention window

How long you keep the decision record is a legitimate-interests judgement. Most legal advisers in Ireland suggest 12 months as the minimum for defending against discrimination claims under the Equal Status Act, 24 months as a maximum unless the applicant has indicated they may pursue a claim.

The key is consistency. Pick a window, document it in your data retention policy, apply it without exception. Inconsistent retention is itself a GDPR vulnerability.

The Equal Status Act context

The Equal Status Act prohibits discrimination on nine grounds plus HAP receipt. If a rejected applicant alleges discrimination, the burden of proof is shared but the practical defence is your decision record. No record means no defence.

The right shape is a structured decision record per applicant: scoring summary, reason for rejection, comparison against the successful applicant. Rentalize Select produces this automatically as a side effect of the scoring workflow, the same workflow we covered in our AI tenant screening piece.

What to do when an applicant exercises their rights

1. Access request. Give them a copy of what you hold within one month, free of charge. The decision record, not the raw evidence (which by this point should be deleted).
2. Erasure request. Delete unless you have a documented legitimate interest in retention (the discrimination-defence basis). If you retain, explain why.
3. Rectification request. Correct any factual error in your records.
4. Objection request. Stop processing for the stated purpose unless the legitimate interest overrides.

Document your response in every case. The DPC’s first question on a complaint is ‘how did you respond to the request’, and the answer needs to exist in writing.

How Rentalize handles this for you

Rentalize Select retains the decision record and not the raw evidence, on a configurable retention window per scheme. Subject access requests can be fulfilled in minutes, not days. Erasure requests trigger automatic deletion across the platform with audit trail. The whole regulatory posture is operational, not aspirational.

If you are still managing rejected applicants in email folders, the cheapest moment to fix that is before a complaint arrives, not after.

Frequently asked questions

Do I have to delete rejected applicant data?

Eventually, yes. The defensible retention window is 12-24 months, after which the data should be deleted unless there is a documented ongoing reason to retain.

What about the raw documents like payslips?

Delete soon after the decision. Retain the decision record and the summary of the evidence, not the raw documents.

What is the lawful basis for retention after rejection?

Legitimate interests, specifically the defence against discrimination claims under the Equal Status Act.

What if the applicant asks for their data?

Provide a copy within one month, free of charge. Provide the decision record.

What if they ask for deletion?

Comply unless your retention basis is stronger than their objection. Document the decision in either case.

What happens if a DPC complaint is filed?

DPC will ask for evidence of your retention policy, evidence of how you responded to the data subject, and evidence of your decision basis. Records that do not exist will not save you.

If you would like to see how Rentalize handles this in practice, you can book a 20-minute walkthrough. We will use one of your own properties as the worked example.