A legitimate screening purpose is not a blank cheque for an unredacted identity-and-employment dossier.
Quick answer: A prospective landlord in Poland may have a legitimate reason to verify a future tenant's identity and ability to pay. That does not automatically make it necessary or proportionate to receive and retain complete copies of a passport,
karta pobytuand employment contract through ordinary email. Ask what fact each document is meant to prove, whether the landlord needs to inspect it or keep a copy, the GDPR legal basis, recipients, security and deletion period. Offer the least intrusive proof that works: in-person identity inspection, a narrow employment-and-income certificate, redacted payslips or a limited bank extract. The official sources reviewed did not identify a general Polish equivalent of the UK's private-landlord “Right to Rent” duty.
Editorial note: This article uses an anonymized, unverified rental-application scenario in Mazowieckie. GDPR coverage and the proportionality of a request depend on the housing arrangement, purpose, processing and documents. This article provides general information, not Polish legal, immigration, financial or cybersecurity advice.
One Email Can Contain Three Different Privacy Questions
Consider a non-EU applicant who has found a flat they like. The prospective landlord sends a draft lease by email, then asks the applicant to email copies of:
- a passport;
- a Polish residence card (
karta pobytu); and - the complete employment contract.
The landlord may be trying to answer reasonable questions: Who will sign the lease? Can the applicant afford the rent? Is the employment expected to continue through the proposed term?
The request still raises three separate questions:
- What fact needs to be verified?
- Why is a retained copy necessary instead of viewing the original or receiving narrower proof?
- How will the data be secured, used and deleted?
“This is common” does not answer them. Neither does “the landlord is a private person.”
A Private Landlord Is Not Automatically Outside GDPR
GDPR excludes processing by a natural person only when it occurs in a purely personal or household activity. Recital 18 says that activity has no connection to professional or commercial activity. GDPR also expressly defines a controller as a natural or legal person who determines why and how personal data are processed. GDPR Recital 18 and Articles 2 and 4
The Court of Justice of the European Union has said the household exemption must be construed narrowly. Its decision concerned residential CCTV, not rental screening, so it is an interpretive principle rather than a Polish landlord ruling. CJEU: Case C-212/13, Ryneš
Poland's data-protection authority, UODO, likewise warns that merely acting privately or non-professionally does not establish the exemption. Publicly marketing a self-contained flat, screening applicants, storing their dossiers and selecting a rent-paying tenant are strong signs of outward-facing market activity. It is unsafe to assume GDPR disappears because the owner has only one property or is not a company. A genuinely domestic arrangement—such as choosing someone to share the owner's own home—can be more fact-sensitive. UODO: Controller and Household-Scope Guidance
The careful conclusion is:
A private landlord may still be a GDPR controller. The actual activity, not the landlord's job title, determines the analysis.
A Lawful Purpose Still Has Five Limits
Even when screening has a lawful basis, GDPR Article 5 continues to apply.
| Principle | What the landlord should be able to explain | What it means for the applicant |
|---|---|---|
| Purpose limitation | The specific purpose for each item | “Tenant screening” should not hide unrelated immigration profiling, marketing or background checks |
| Data minimisation | Why each field and each retained copy is necessary | Prove income or identity with the smallest effective record |
| Storage limitation | A deletion date or objective retention rule | Rejected-applicant scans should not remain indefinitely in a personal inbox |
| Transparency | Controller, legal basis, recipients, retention, rights and consequence of refusal | Request the Article 13 information before or when the documents are collected |
| Security | How access, transmission and storage are protected | Open attachments containing multiple identity documents create avoidable risk |
GDPR Articles 5, 13 and 32 · EDPB: Secure Personal Data
Consent is not a magic answer
Screening may sometimes rely on steps necessary before entering a contract under Article 6(1)(b), or on a carefully balanced legitimate interest under Article 6(1)(f). A true legal obligation requires an identifiable EU or Polish law. GDPR Article 6 · EDPB Guidelines on Legitimate Interests
Consent must be freely given, specific and informed. Conditioning access to housing on consent to unnecessary processing can undermine whether the choice is free. A checkbox or an applicant's anxious “yes” does not cure collecting more data than the purpose requires. GDPR Articles 4 and 7
Verify the Fact, Not the Entire File
The most useful response is not “I refuse everything.” It is “Which proposition do you need me to prove?”
| Landlord's purpose | Proportionate starting point | More intrusive step requiring a specific explanation |
|---|---|---|
| Confirm identity | View one original identity document and record only necessary lease fields | Keep full images of both passport and residence card |
| Confirm employment | HR employment certificate naming employer, contract type and duration | Complete employment contract with every clause and signature |
| Confirm income | Narrow income certificate, redacted payslip or limited account extract | Full bank history revealing unrelated transactions |
| Confirm expected ability to perform a fixed lease | Contract end date or employer confirmation | Immigration and employment dossier extending beyond the lease question |
| Address added risk lawfully | Neutral guarantor or transparent third-party verification where proportionate | More intrusive evidence demanded only because the applicant is foreign |
These alternatives are not a universal statutory checklist. They apply GDPR's minimisation and necessity tests to common rental purposes.
Why the complete employment contract is often too much
Poland's State Labour Inspectorate explains that an employment contract typically identifies the parties, contract type and date, type and location of work, remuneration and its components, working-time fraction and start date. It may also contain benefits, restrictions and other terms. State Labour Inspectorate: Employment Contract Guide
If the landlord only needs “employed since X, fixed until Y or indefinite, with income Z,” an HR zaświadczenie o zatrudnieniu i zarobkach can provide that answer without disclosing:
- detailed job duties or workplace location;
- bonus formulas and benefits;
- internal restrictions or confidential projects;
- employer representatives' personal data and signatures; or
- other clauses unrelated to rent.
A work contract is not automatically Article 9 “special-category data.” Salary, PESEL, employer and document numbers are still personal data protected by GDPR. An unusual contract or attachment could also reveal health, disability or trade-union information, which raises an additional Article 9 question.
A bank statement is not automatically safer
A complete bank statement may reveal medical payments, political or religious donations, family transfers, travel and everyday behaviour. If income proof is necessary, offer a limited extract showing recurring salary credits or an account balance, with unrelated transactions and identifiers hidden where feasible.
Redaction must minimise irrelevant information, not falsify identity, income or contract duration.
Viewing a Document Is Different From Keeping a Copy
UODO advises people, as a general rule, to question identity-document copying and ask for the legal basis. It also explains that even an institution with an express statutory power to copy must still assess whether copying is necessary for the particular transaction. UODO: Do Not Allow Routine Identity-Document Copies · UODO: Copying IDs Requires Necessity Analysis
That does not create a simple rule that every landlord copy is illegal. It establishes the right question:
Why must the landlord retain every field, photograph, signature and security feature instead of checking the original and recording the minimum necessary data?
A passport plus a residence-card copy may also duplicate the same identity evidence. The landlord must justify the copying and retention, not only the general desire to know who will occupy the flat.
Poland Does Not Use the UK's Rule by Analogy
The official Polish sources reviewed for this article did not identify a general equivalent of the UK's private-landlord “Right to Rent” regime.
Polish Border Guard guidance says legal-stay controls can be conducted by specified public authorities, including Border Guard, Police and authorised officials. It does not list ordinary private landlords as legal-stay-control authorities. Nadwiślański Border Guard: Legal-Stay Controls
Polish Criminal Code Article 264a prohibits enabling or facilitating an unlawful stay for financial or personal benefit. Its text does not create a blanket duty for every residential landlord to copy and retain a passport, residence card and employment contract. Polish Criminal Code, Article 264a
The absence of a general immigration-policing duty does not forbid every status-related question. A landlord may have a legitimate, proportionate reason to confirm identity, likely lease duration or ability to perform the contract. If the landlord says all three copies are legally mandatory, ask for the exact Polish provision and which fields it requires.
Do not use a UK, German or other country's practice to answer Polish law.
Collect Data in Stages, Not All at Once
The information needed changes as the application progresses.
| Stage | Usually proportionate starting point | Escalate only when justified | Strong over-collection signal |
|---|---|---|---|
| Initial enquiry or viewing | Name, contact, move-in date, household size and self-declared affordability | Neutral description of accepted proof options | Passport scans, residence-card scans and complete work contract before viewing |
| Preferred-applicant screening | View identity original; narrow HR or income proof | Selected redacted contract clauses, lawful guarantor or transparent verification service | Unredacted copies of all three documents by open email without explanation |
| Contract signing | Necessary party, contact and service details; signature; lease and payment terms | Record a document number or validity date only when justified | Keep every field and image because it is available |
| Tenancy administration | Signed lease, payment, handover inventory, repair and claim records | Records needed for an identified tax, accounting or legal-claim period | Reuse application data for unrelated purposes |
| Rejected or withdrawn application | Delete high-risk documents promptly; retain only a narrow decision record if genuinely necessary | Preserve relevant material for a concrete dispute | Keep complete application files indefinitely “just in case” |
A Safer Document-Sharing Workflow
1. Verify the property and requester
Before sending identity documents, verify that the recipient owns the flat or is authorised to represent the owner. Compare the draft lease, property details and contact information. Pressure to send documents before a viewing or independent verification is a serious risk signal.
2. Ask for the privacy notice
Request:
- the controller's identity and contact details;
- the purpose and Article 6 basis for each document;
- the legitimate interest, if that is the basis;
- recipients and any verification provider;
- storage location and security method;
- retention or deletion period;
- applicant rights; and
- the consequence of declining each document.
3. Propose narrower evidence
Offer to:
- show the passport or residence card in person;
- allow recording of agreed necessary fields;
- provide an HR employment-and-income certificate;
- send a redacted payslip or limited bank extract;
- use a lawful guarantor; or
- use a disclosed verification service after reviewing its privacy terms.
4. Agree the fields before redacting
Ask which fields the landlord actually needs. Watermark an electronic copy for the named recipient, property and single application purpose without covering necessary security features. Redaction and watermarking reduce misuse risk; neither creates a legal basis or makes excessive collection lawful.
5. Use a safer transfer method
UODO's email-security materials identify open scans, contracts and forms as a recurring breach mechanism. Prefer in-person inspection or an authenticated portal. If a copy is genuinely necessary, use an encrypted file and send the password through a separate channel. UODO: Email-Security Bulletin
6. Obtain a deletion commitment
Ask what happens if another applicant is selected. A valid answer may distinguish prompt deletion of high-risk scans from narrowly retaining evidence needed for a specific legal claim. “We keep everything forever” is not a retention schedule.
A Message You Can Send the Landlord
Thank you for sending the draft lease. I understand that you need to verify my identity and ability to pay the rent. Before I send copies, could you please confirm the purpose and legal basis for each document, who will have access to it, how it will be secured and when it will be deleted if the tenancy does not proceed? I can show my original passport and residence card in person and provide an HR certificate confirming my employment type, duration and income. Would that satisfy the screening requirement instead of retaining full copies of all three documents?
If the landlord genuinely needs one retained field or page, follow with:
I am willing to provide evidence of employment and income, but the full employment contract contains terms unrelated to the tenancy. I can provide a redacted copy showing my name, employer, contract type, start or end date and income, or a recent employer certificate. Please confirm the specific fields required and the document's retention period.
This response does not accuse the landlord of fraud. It recognises the screening purpose while testing whether the collection is proportionate.
Refusing a Full Copy Does Not Guarantee the Flat
GDPR does not force a landlord to accept an applicant. A landlord can choose a contracting party subject to applicable law. An applicant who refuses a document may lose the opportunity in a competitive market.
That practical pressure does not make every condition lawful. The landlord should use neutral, consistently applied affordability and identity criteria. Poland's Equal Treatment Act applies to publicly offered housing services and prohibits unequal treatment on specified grounds including race, ethnic origin and nationality, subject to important private-sphere and third-country-status qualifications. Polish Equal Treatment Act, Articles 4–6
Do not assume every residence-card request or rejection of a non-EU applicant proves discrimination. Do not accept “foreigners are risky” as a data-minimisation or necessity analysis either. Preserve written evidence if more intrusive requirements appear to be imposed only on a protected group, and obtain Polish legal advice on the particular facts.
If You Already Sent the Documents
Sending a scan does not mean identity theft has occurred. Start with an information and deletion request.
Under GDPR, an applicant may ask whether personal data are processed, the purposes, categories, recipients and retention, and obtain access to the data. Erasure can apply when the data are no longer necessary or were unlawfully processed, but it is not absolute; legal obligations and the establishment, exercise or defence of claims can support limited retention. GDPR Articles 15, 17, 18 and 21
Use a focused request:
As the rental application did not proceed, please confirm whether you still process personal data relating to me. Please provide the purposes, legal bases, data categories, recipients and retention periods, and a copy of the data being processed. Please erase my passport, residence-card and employment-document copies if they are no longer necessary, or explain the specific ground and retention period for any item that must be kept. Please confirm when deletion is complete.
UODO recommends exercising rights with the controller first. A controller generally must respond without undue delay and within one month, subject to a possible extension for complex requests with timely notice. If the response is absent or inadequate, a person may submit a formal complaint to the President of UODO with supporting evidence. UODO can order compliance; compensation is a separate civil-court question. UODO: Rights and Complaint Procedure
If a leak or unauthorised disclosure is suspected
Ask what data was affected, when, who received it and what containment occurred. GDPR requires controllers to document personal-data breaches, notify the supervisory authority within 72 hours where the breach is likely to risk people's rights and freedoms, and communicate high-risk breaches to affected people without undue delay. GDPR Articles 33 and 34
Do not report a physical passport or residence card as “lost” solely because a scan was sent. Ask the issuing authority what the particular compromise requires.
PESEL Restriction Helps With One Part of the Risk
Adults who have a PESEL can restrict it immediately and free of charge through the official service. Since June 1, 2024, specified institutions must check the restricted-PESEL register before certain credit or loan transactions. Gov.pl: Restrict or Unrestrict a PESEL Number
Restriction can reduce exposure to some identity-loan fraud. It does not:
- remove a leaked scan from email, backups or devices;
- stop every private contract or form of impersonation;
- prove income or lawful residence;
- regulate the landlord's document collection; or
- replace minimisation, secure transfer and deletion.
Do not recommend the service to an applicant who does not have a PESEL; the official service is for adults with a PESEL.
Lower-Risk and Higher-Risk Responses
| Landlord response | Signal | Applicant action |
|---|---|---|
| Explains purpose, basis, recipients and deletion; accepts narrow proof | Lower risk | Verify the property and provide minimum proof through the agreed channel |
| Views originals and records only necessary fields | Lower risk | Bring originals, keep possession and ask which fields are recorded |
| Accepts an HR certificate instead of the full contract | Lower risk | Provide a tailored certificate with unrelated data excluded |
| Claims GDPR never applies to an individual landlord | High compliance concern | Ask again in writing and do not send copies until clarified |
| Says Polish law requires all three copies but cannot identify it | High concern | Request the exact provision and consider independent advice |
| Demands unencrypted email attachments with no retention answer | High security concern | Offer in-person review, encrypted transfer or an authenticated portal |
| Requires materially more data only from foreign applicants | Fairness and discrimination concern | Ask for the neutral policy applied to all applicants and preserve the response |
| Pressures immediate submission before verifying ownership | Fraud and over-collection concern | Pause, verify the recipient and consider another property |
Where Pine Fits
A document request can quickly spread across the listing, draft lease, email thread, privacy notice, employment records and identity documents. The useful question is not simply “Did the landlord ask?” It is whether each requested field matches a stated purpose and whether the data trail is controlled.
Open Pine to organise the listing, draft lease, document request, proposed alternatives and replies into a dated file; identify unanswered privacy questions; and prepare a focused follow-up for the landlord, UODO or a qualified Polish adviser. Pine does not determine GDPR legality, verify ownership, redact identity documents for you, provide immigration advice or guarantee tenancy approval or deletion.
Frequently Asked Questions
Is it illegal for a Polish landlord to ask for my employment contract?
Not automatically. The landlord may have a legitimate affordability purpose, but needs a lawful basis and must collect only what is necessary. An HR certificate, redacted payslip or selected contract information may establish income and employment duration without the complete agreement.
Does GDPR apply to an individual landlord?
It can. The exemption is limited to purely personal or household activity. Publicly marketing a flat and systematically screening rent-paying applicants should not be assumed to be exempt. A genuinely domestic house-sharing arrangement can be more fact-sensitive.
Must a Polish landlord check a non-EU tenant's right to rent?
The official sources reviewed did not identify a general Polish equivalent of the UK's private-landlord Right to Rent duty. Ask for the exact Polish provision if copies are described as legally mandatory. A landlord may still have a proportionate reason to verify identity or expected ability to perform the lease.
Can the landlord copy my passport or residence card?
The copy itself must be necessary and proportionate, not merely convenient. UODO warns against routine identity-document copying. Viewing the original and recording limited necessary fields may be a less intrusive option.
Is salary information “sensitive personal data” under GDPR?
It is personal and financially sensitive in ordinary language but is not automatically Article 9 special-category data. It still receives GDPR protection and must be minimised and secured.
Should I send a complete bank statement instead?
Usually not. A full statement can reveal unrelated transactions and private behaviour. Use a limited extract or another proof showing only the required affordability information.
Does restricting my PESEL make document sharing safe?
No. It can reduce exposure to specified credit and loan fraud, but it does not prevent all misuse, delete scans or replace secure collection and deletion.
Can I demand that the landlord delete my documents?
You may request erasure, but the right is not absolute. If the application ends and the documents are no longer necessary, deletion may be required. Narrow data may remain for a legal obligation or defence of claims, and the landlord should explain the ground and retention period.
Where can I complain?
First exercise your rights with the controller in writing. If the response is missing or unsatisfactory, UODO accepts formal data-protection complaints. Equality or compensation questions may require a different route and qualified Polish legal advice.
Official Sources
- GDPR
- CJEU: Case C-212/13, Ryneš
- EDPB: Guidelines on Legitimate Interests
- UODO: Rights and Complaint Procedure
- UODO: Do Not Allow Routine Identity-Document Copies
- UODO: Copying IDs Requires Necessity Analysis
- UODO: Email-Security Bulletin
- Nadwiślański Border Guard: Legal-Stay Controls
- State Labour Inspectorate: Employment Contract Guide
- Gov.pl: Restrict or Unrestrict a PESEL Number
- Polish Equal Treatment Act
This article provides general information about data-protection and rental-screening issues in Poland. It is not legal, immigration, financial or cybersecurity advice. The lawful result depends on the property arrangement, the landlord's purpose, the data requested, the proposed lease and the applicant's status. For advice on a specific request, contact a qualified Polish lawyer, UODO or the relevant immigration authority.
