An application file holds a Social Security number, a date of birth, an ID number, bank and employer details and a consumer report. Federal rules require that consumer report information be “securely disposed of” when no longer needed — “burning, pulverizing, or shredding paper documents and disposing of electronic information so that it can’t be read or reconstructed” (FTC) — and a landlord who mishandles identifiers faces state identity-theft and data-breach duties as well. The practical rule is: collect through a secure channel, store in one place with restricted access, and dispose on a schedule.
Collect
- Applications through a portal or an encrypted form, not by text message or a photograph of a paper form.
- Identification: see it; record that it was seen and its type; copy it only if your process needs the copy and can protect it.
- Consumer reports: obtain them through the agency’s secure portal; do not have them e-mailed as attachments to a shared inbox.
Store
| Data | Where | Who |
|---|---|---|
| Application and consent | Encrypted folder per property, or the screening platform | Owner and the person who screens |
| Consumer reports | Inside the screening platform, not downloaded, where possible | Screener only |
| ID copies | Same folder as the application; never in e-mail or chat | Owner and screener |
| Decision note and adverse action notice | With the application | Owner and screener |
| Paper | Locked cabinet; no application forms left in the unit or a car | Owner |
Dispose
- Set the retention period in writing — for declined applicants, only as long as needed to answer a complaint; for tenants, the application stays with the lease file.
- Shred paper; delete electronic files and empty the trash; ask the screening platform to purge reports on schedule.
- Log the disposal date per file.
- Never reuse a report for a later application without a fresh consent — the report was obtained for one purpose.
Sharing
A co-owner, a spouse, a manager or a contractor sees the file only if they need it to decide or to act. The access control guide sets the permissions; the rule here is that a consumer report is used only for the purpose for which it was obtained and is shown to no one else.
Frequently asked questions
How must consumer reports be disposed of?
Securely — shredding, burning or pulverising paper and rendering electronic information unreadable — once they are no longer needed (FTC).
Can applications be accepted by text or e-mail?
They can be, but identifiers sent that way sit in unencrypted inboxes; a portal or encrypted form is the safer channel.
How long should a declined application be kept?
Only as long as needed to answer a complaint about the decision — set the period in writing, then shred and delete on schedule.
Sources
Rules change and the right answer can depend on the home, the city, the lease and the timing. These are the official pages this guide relies on; check them before signing, charging a fee, sending a notice or making a legal decision.
- FTC — Using consumer reports: what landlords need to know ↗
- CFPB — Tenant screening reports (key terms) ↗
- FTC — Cybersecurity for small business ↗
General information for U.S. landlords, with a Texas focus. This guide is not legal, tax or accounting advice. Consult a qualified professional for your situation. Written by the rentalfreelease.com Editorial Team; last reviewed September 19, 2026.