Requesting SCHUFA and income in line with the GDPR
Tenant applications touch several particularly sensitive data categories: income proofs, bank details, SCHUFA self-disclosures and possibly information on marital status or profession. For all these fields the strict purpose limitation of the GDPR applies — you may only ask what is actually necessary for pre-qualification. With the self-disclosure, the tenants association already established in a model form in 1995 which questions are permissible, and this list has hardly changed.
Therefore only ask about income and SCHUFA when the applicant is fundamentally interested in the apartment and the apartment is still available. A two-stage query — first short initial inquiry, then on invitation the detailed application — is GDPR-compliant and considerate of the applicants. Do not store the data of those not considered longer than necessary; usually three to six months are sufficient to clarify any legal disputes. After that everything should be deleted — including the uploaded PDFs.