Key takeaways
- Keep only records needed for a stated purpose.
- Screening criteria and adverse-action records need version control.
- Retention periods depend on law, policy, and the record type.
Source record
10 cited sources
Last verified
2026-08-11
Table of Contents
Quick Overview
Rental screening data retention covers applications, consent, reports, decision records, notices, disputes, and deletion logs. The right period depends on federal, state, and local requirements, the record's purpose, and litigation or audit holds. This article is an operations framework, not legal advice.
The FTC landlord background-check guidance explains duties when consumer reports inform a housing decision. The CFPB tenant screening report page explains consumer rights and report accuracy concerns. The HUD Fair Housing guidance provides a separate nondiscrimination context.
Record classes
Separate application data, screening output, decision rationale, and communications. The NIST Privacy Framework supports purpose and data-minimization thinking. The NIST Cybersecurity Framework supports access and incident controls. The FTC Safeguards Rule may apply to covered organizations, so confirm scope with counsel.
The EEOC recordkeeping rules concern employment records, not a universal housing schedule. The Federal Trade Commission FCRA overview and DOJ fair housing resources show why a policy needs a legal review.
Retention table
| Record | Control | Review question |
|---|---|---|
| Consent | Timestamp and version | Was permission captured? |
| Report | Vendor and subject match | Is access limited? |
| Decision | Applied criteria version | Can the outcome be explained? |
| Notice | Delivery evidence | Was the required notice sent? |
The CISA data security guidance, FTC identity protection guidance, and IRS data-security publications add security context. They do not establish a housing retention period.
Common mistakes
Do not retain every document forever. Do not delete records under a legal hold. Do not change criteria for one applicant without recording the approved policy version.
Common Questions Answered
What should deletion prove?
Record what category was deleted, when, why, by which approved process, and whether a hold prevented deletion.
Can a vendor decide retention?
The owner remains responsible for the policy and vendor oversight. Contract terms should identify access, deletion, and incident handling.
Ready to improve application records?
Use the application document review to separate evidence from unnecessary copies.