™Going digital
Digitising your tenancy: from paper to secure records
Digital records can make contracts, receipts and correspondence easier to search and share. Their safety depends on access controls, backups and the provider you choose. Handling tenant data also requires checking the applicable data-protection rules.
Why go digital
- Organise the contracts, receipts and messages the tenancy needs; avoid keeping identity-document copies without a specific need and lawful basis.
- Choose and test backups and version history; a cloud account alone does not guarantee either.
- Faster tax season: deductible expenses and receipts are already organised.
- Control who can access shared records and review access when a tenancy or professional relationship ends.
GDPR applies — even to a spreadsheet
The GDPR applies to automated personal-data processing and to paper records forming, or intended to form, part of a filing system. A purely personal or household activity may be exempt, but commercial letting should not assume that exception. Check whether the rules apply to your activity. The main principles include:
- Data minimisation: collect only the tenant data the tenancy actually needs.
- Storage limitation: set retention periods instead of keeping records forever.
- Security: protect data with appropriate measures — encryption is a recommended example, sized to the risk.
- Lawful basis: identify an appropriate basis for each purpose; a contract, legal obligation or properly assessed legitimate interest may apply, depending on the processing.
The EU-hosting question
The GDPR does not require EU-only hosting. Transfers outside the EU/EEA may require an adequacy decision or other lawful safeguards. An EU or EEA server location alone does not rule out international transfers: support access and subprocessors may be elsewhere. Check the provider, processing agreement, access locations and any required transfer safeguards.
Note: this is general information, not legal advice. Data-protection specifics (and record-retention periods) vary by country — check with your national Data Protection Authority for your situation.