The rule is the purpose, not a calendar
Neither the Data Protection Act (DSG) nor the FDPIC leaflet names a period in days or months for rental applications. Both tie the answer to the purpose: you collected the documents to choose a tenant for one flat. When that choice is made and the lease is signed, the purpose is gone for everyone who was not chosen.
What the sources say, in order
- Art. 6 Abs. 3 DSG: personal data may only be collected for a specific purpose that the person can recognise, and only be processed in a way compatible with it.
- Art. 6 Abs. 4 DSG: they are destroyed or anonymised as soon as they are no longer needed for that purpose.
- FDPIC leaflet on rental application forms (updated 15 July 2025): keeping data longer than the processing requires can breach the principle of proportionality.
- Same leaflet: after the lease is signed, the landlord must destroy the application forms with all attachments of the other applicants, unless there is a special justification.
- Same leaflet: once the flat is let, the data of the other applicants must be destroyed as quickly as possible.
Typical cases
| Situation | What the FDPIC leaflet says |
|---|---|
| Applicant not chosen, lease signed | Destroy form and attachments |
| Copy of the debt collection extract of an applicant not chosen | Destroy it with the application documents after the letting process |
| You want to keep the dossier for the next flat | Only with the person's consent, for example an entry in a waiting list |
| Passing a dossier to another property manager | Only with the person's consent |
Three things agencies often miss
- Copies count. The dossier sits in the shared mailbox, in the download folder, in the printout on the desk. Destroying means all of them.
- Access matters before deletion too. The leaflet asks that applicant data be accessible only to the people who make the selection, and to as few as possible.
- Applicants can ask. Under Art. 25 Abs. 2 lit. d DSG, a person who requests access is told how long their data are kept or, if that is not possible, the criteria that determine the period. Have an answer ready.
How aptari handles it
- Applications for a listing sit in one sorted list, not in personal inboxes.
- Declined applications are deleted 30 days after the decision.
- The decision itself is always made by a person at your agency. aptari never decides and never declines automatically.
This is general information, not legal advice.