How Portland Landlords Should Protect Tenant and Applicant Data

Recently, we talked about Oregon’s new tenant privacy protections and why landlords need to think carefully about how they protect tenant and applicant data. HB 4123 raised the stakes by creating significant penalties for improper disclosure, making tenant privacy more than just good business. But best practice for tenant and applicant data goes beyond how you knowingly share their information. It also impacts how you store and protect that data.

So what happens after you’ve collected your tenant’s most sensitive information? Every rental application, lease agreement, screening report, and maintenance request creates another piece of personal data that someone has trusted you to protect. Large apartment companies usually have IT departments and security policies to manage that responsibility; many independent Portland landlords have a filing cabinet, a laptop, and an email account. That makes good cybersecurity practices, more so even than particular programs, especially critical.

Keep Records Organized

Many landlords underestimate just how much confidential information passes through their business during a normal leasing cycle. But a rental application alone may contain a tenant’s full legal name, date of birth, driver’s license number, phone number, email address, employer information, income documentation, previous addresses, emergency contacts, banking information, and more. Screening reports often include a social security number, credit history, and criminal records. Once someone moves in, the file continues to grow through maintenance requests, payment records, lease renewals, correspondence, and accommodation documentation.

Some landlords also keep copies of tax forms, insurance paperwork, utility information, or identity documents long after they have served their purpose.
You can’t protect tenant and applicant data if you don’t know where it lives. Start by identifying every location where tenant records exist, including paper files, email folders, cloud storage, accounting software, property management platforms, mobile phones, backup drives, and personal computers. There are a myriad of places where data ends up stored, either by you or secondhand companies; many owners even discover they have duplicate records scattered across several devices without realizing it.

Store Information With Intention

Once you’ve identified your records, the next step is deciding how to store them. You wouldn’t leave sensitive paper records lying around a public office, and digital records deserve the same level of attention, if not more so.

Every computer that stores tenant information should require a strong password, automatic screen locking, and current security updates. If you’re using cloud storage, enable multi-factor authentication so logging in requires more than just a password. You should also avoid saving tenant files on shared family computers or devices that several people use. It only takes one accidental click on a malicious email attachment to create a much larger problem.

Email Is Usually the Weakest Link

Landlords rely heavily on email because it’s convenient, but convenience often creates unnecessary risk. Applicants routinely email critical pieces of documentation that then remain in your inbox for years. Instead of treating your email account as permanent storage, move important documents into a secure location and delete copies from your mailbox. The same principle applies to attachments sitting in your computer’s downloads folder.

Be careful when sending information as well. Double-check recipient addresses before attaching documents, and avoid forwarding sensitive records unless there is a legitimate business reason to do so.

Keeping Everything Forever Isn’t a Good Strategy

We often emphasize the importance of keeping documentation in case of a dispute or legal action. However, keeping everything with no limit on when you delete it is not only a great way to find yourself drowning in paperwork; it can increase your risk exposure.

Records that no longer serve a legal, tax, accounting, or operational purpose should eventually be disposed of securely. Oregon law requires certain documents to be maintained for specific periods, so you should never destroy records that may still be needed to satisfy legal obligations or defend against future claims.

Once those retention periods have passed, securely deleting electronic records and shredding paper documents reduces the amount of sensitive information that could be exposed during a future breach. Creating a simple document retention schedule can make this process much easier.

Vendors Need Security Too

Landlords rarely work alone. Maintenance coordinators, property managers, screening companies, software providers, accountants, and attorneys may all receive tenant information while helping operate a rental property. That makes your cybersecurity only as strong as the people you choose to work with.
Before striking up a working relationship, ask prospective vendors how they protect customer information, who has access to tenant records inside their organization, and how long information is retained. Reputable companies should be able to explain their security practices without hesitation.

And of course, make sure you’re not sharing sensitive information that you aren’t legally permitted to disclose.

If You Experience a Data Breach

No security system is perfect. If you believe tenant information has been exposed, fast action is key. You’ll need to identify what happened and isolate affected systems so additional information isn’t compromised.

Oregon’s data breach notification law may require businesses to notify affected individuals when certain categories of personal information have been accessed without authorization. Depending on the circumstances, you may also need to work with law enforcement, financial institutions, or other organizations involved in responding to the incident.

While ransomware is a frightening prospect, one thing many landlords fail to consider is that the legal fallout of a data breach can be just as expensive. If you are found negligent, you could be liable for damages.

Prevention Is Less Expensive Than Cleanup

Cybersecurity has become another part of responsible property management. Just as landlords inspect roofs before leaks appear and service furnaces before winter arrives, tenant information deserves routine attention before a problem develops. One of the most critical steps to protect tenant and applicant data involves working with an experienced property manager with strong cybersecurity and records management practices.

If you’d like to learn more about how we keep your tenant and applicant data safe, call Rent Portland Homes Darla Andrew’s Office at (503) 515-3170, or contact us through our website. We’d love to talk to you about how our strong privacy practices help Portland landlords reduce risk while building lasting trust with their residents.