Got comments or ideas?
Drop us a line! Your feedback helps us make WOHNO better.
A repeatable process for private landlords: pre-sort applications, build a shortlist, organise viewings cleanly (one-on-one instead of group), coordinate appointments, decline fairly – and which applicant data you must delete after letting under the GDPR.
An attractive apartment in a major city now draws 50, 100 or more enquiries – within hours. What feels like a luxury problem at first quickly tips into chaos: an overflowing inbox, double-booked appointments, applicants who never hear back, and ultimately a nagging doubt about whether the decision was really the right one. The bottleneck is rarely demand – it's the missing process.
This guide walks you through a calm, repeatable flow from the first application to the signature. It's tailored to private landlords and small operators without an agency behind them, and it takes seriously the two things that most often go wrong in practice: organising the viewings and handling your applicants' data. The latter is not a bureaucratic footnote – since the updated DSK guidance (Datenschutzkonferenz, the German data protection authorities) of January 2026, it is a sharply defined set of duties.
The first mistake happens before the first viewing: treat every enquiry the same and you drown. The fix is – a two-pass review that reduces the mass to a manageable number in minutes.
Decide on two or three hard, non-negotiable criteria in advance – a minimum income, say, or the number of people moving in. Crucial: these criteria must be objective and free of discrimination. Which characteristics you may ask about and which are off-limits is covered in our guide to selecting tenants by fair criteria. Then, in a first pass, sort only by these knockout points – without reading every application in detail.
The second pass produces your shortlist: the handful of applicants you actually invite to a viewing. For a single apartment, five to eight serious candidates are usually enough. More appointments mean more effort without noticeably improving the quality of the decision – and they produce unnecessarily many rejections that you later have to communicate fairly.
What matters just as much is what you do not do yet: no payslips, no credit report, no completed form. At this stage you only need the name and contact details to arrange an appointment. Everything else comes later – and that isn't just good manners, it's what data protection law requires (more on that shortly).
Before and during the viewing, collecting name and contact details is enough. The self-disclosure (Selbstauskunft) belongs in the narrower selection – not in a bulk form by the apartment door.
The group viewing (Sammelbesichtigung) – funnelling twenty prospects through the apartment at the same time – looks efficient. You save appointments, create visible competition, you're done in an hour. But that supposed efficiency comes at a high price, both in atmosphere and in law.
Pros: a calm conversation, honest questions in both directions, a realistic picture of the person rather than their behaviour in a crowd. You collect data only from the few you invited – clean in terms of data minimisation. Prospects feel respected, which raises the share of serious self-disclosures.
Cons: more appointments, more coordination, more time. With very high demand you have to keep the shortlist disciplined and small.
The legal core: at an open mass viewing that anyone can attend without pre-selection, the landlord may as a rule only collect a name and phone number – there is no legitimate interest in further data at that point. The self-disclosure form laid out at the first mass viewing is a textbook breach of the data minimisation principle in Art. 5(1)(c) GDPR; the form belongs in the hands of the narrower selection only after the appointmentQuelle.
With the DSK guidance of January 2026, the permissible scope of data is clearly split into three phases – and your questions should follow exactly that structureQuelle:
Off-limits across all phases remain questions about marital status, pregnancy, criminal record, party, religion or ethnic origin. Keeping so-called "black lists" of rejected applicants is prohibited.
In substance, the viewing serves you best when you run it as a mutual getting-to-know-you: be open about the ancillary costs, the building community, planned works. Ask about the move-in date, how long the interest holds, and whether everything fits the prospect's situation. A listing that was already honest and complete saves you many follow-up questions here – our piece on the good apartment listing shows how.
Scheduling is the underrated time sink. Coordinating eight prospects individually by WhatsApp, email and phone call – with reschedules, cancellations, follow-ups – easily eats half a workday. Three principles keep it lean:
Rejections are the part almost everyone postpones – and the part that does the most reputational damage when it's left out. Hearing nothing for weeks makes people feel ignored. Yet a fair rejection takes two minutes and three simple rules:
On WOHNO you don't have to retype rejections like this every time: you save them once as a message template and decline – several applicants at once when needed – with a few clicks. That way no one is left in the dark for weeks, and you lose no time.
Once it's signed, a duty begins that many landlords overlook: the data of all unsuccessful applicants must not simply sit around "for the next tenant change". The GDPR sets out two clear principles – storage limitation (Art. 5(1)(e) GDPR) and the right to erasure (Art. 17 GDPR): personal data must be deleted as soon as the legal basis for using it falls away.
rejected applicants
3 months
AGG safety buffer from rejection
2026 DSK ceiling
≤ 6 months
delete at the latest by then
data no longer needed
immediately
credit report / self-disclosure after signing
In concrete terms: the files of rejected prospects are in practice kept for about three months from the rejection. The reason is not hoarding but a legal buffer: under § 21(5) AGG (Germany's General Equal Treatment Act), rejected applicants have two months to assert possible discrimination claims – the three months cover that window with a margin of safetyQuelle
. The updated 2026 DSK guidance draws the ceiling clearly: the data of unsuccessful applicants must be deleted as soon as it is no longer needed for the selection process – as a rule at the latest after six monthsQuelle.
For the chosen tenant the counterpart applies: data that isn't needed for the ongoing tenancy – the credit report or parts of the self-disclosure, say – should be deleted right after the contract is signed. Keep only what you genuinely need to perform the contract.
Two passes: first sort by hard, fair knockout criteria, then actually read the remaining enquiries. Result: five to eight serious candidates – with nothing but name and contact details.
Offer fixed time slots, show the apartment individually rather than en masse. Confirmation after the agreement, reminder the day before. No self-disclosure yet, no documents.
A mutual conversation: be open about ancillary costs, the building, planned works; ask about the move-in date and the prospect's situation. Keep questions within the DSK scope – no off-limits topics.
Self-disclosure only in the narrower selection; payslips or a credit report only after the decision (redacted, only what's necessary). Draw up the contract and sign.
Decline all rejected candidates promptly and kindly. Then: delete the new tenant's unneeded data immediately, and the rejected applicants' data after three to six months.
Manage applicants and appointments in one place
Review enquiries, build your shortlist, coordinate viewings and decline fairly – without inbox chaos. In the WOHNO dashboard, applications and appointments sit in a single view.
Continue with WOHNO
How to write a listing that reaches the right tenants instead of producing 600 enquiries – with the GEG energy-certificate disclosures, correct pricing under the rent cap, an honest description, good photos and a realistic target group.
What you may legitimately assess as a landlord – creditworthiness, income, self-disclosure, freedom from rent arrears – and where the AGG (German equal treatment act, §§ 19, 21) and the GDPR draw hard lines: forbidden questions, the data-protection authorities' three-phase rule for documents, when a SCHUFA report is even permitted, deletion duties after a rejection, and objective criteria as protection against discrimination claims.
Why trust is scarce in a tight market, how a verified profile lowers the landlord's risk – and how you protect yourself against advance-payment fraud, fake listings and identity theft. With GDPR data minimisation as your guide.