No federal rule sets a minimum retention period for a private landlord's applicant files. The FCRA's Disposal Rule governs how you destroy consumer reports, not how long you keep them. The practical floor comes from the Fair Housing Act's limitation periods: one year to file with HUD, two years for a civil action.
Does Any Federal Rule Tell You How Long To Keep Them?
Not for a private landlord. The rule people reach for is the FTC's Disposal Rule at 16 CFR part 682, which does apply: § 682.1(b) defines consumer information as any record that is a consumer report or derived from one, and § 682.3(a) requires anyone holding it for a business purpose to dispose of it by reasonable measures against unauthorized access — shredding, erasure, or a vetted vendor. Notice what is absent: it never says keep the file for N years, only that a dumpster is not a disposal method.
The FCRA's other landlord-facing duty runs the same way. 15 U.S.C. § 1681m(a) requires anyone taking an adverse action based on a consumer report to notify the consumer, name the reporting agency and state that the agency did not make the decision. That is a notice duty owed to the applicant, not a retention obligation. Treating it as one is the most common error in retention advice.
So Where Does the Two-Year Floor Come From?
From how long the claim survives. 42 U.S.C. § 3610(a)(1)(A)(i) lets an aggrieved person file a HUD complaint not later than one year after an alleged discriminatory housing practice occurred or terminated; § 3613(a)(1)(A) allows a civil action not later than two years after the occurrence or termination, whichever is last. Neither is a retention rule. They tell you when a file can still be asked for — and a fair-housing defence rests on the written criteria, the decision's reason, and how other applicants for the same unit were measured. Delete that at nine months and the question still arrives at 20. This is information, not legal advice; rules change and vary by municipality.
What Does a Defensible Schedule Look Like?
| Record | Defensible period | What drives it |
|---|---|---|
| Copy of a credit, criminal or eviction report | No federal minimum; destroy it properly whenever you do | 16 CFR § 682.3(a) — reasonable disposal measures |
| Application, written criteria, decision and reason | Two years past the decision, as a floor | The FHA civil-action window, 42 U.S.C. § 3613(a)(1)(A) |
| Anything used to make a decision affecting a person, in British Columbia | At least one year after using it | PIPA s. 35(1), a hard statutory minimum |
| Tenant records at a low-income housing tax credit property | At least six years after the return due date for that year | Treas. Reg. § 1.42-5(b)(2) |
Real numbers exist, but they attach to a program or a province, not to renting in general — and where one exists, it beats your policy.
What Do Canadian Rules Require?
British Columbia has the number the US lacks. PIPA s. 35(1): if an organization uses someone's personal information to make a decision that directly affects them, it must keep that information for at least one year after using it, so they have a reasonable opportunity to obtain access. Section 35(2) points the other way — destroy or de-identify once it is reasonable to assume the collection purpose is no longer served and retention is no longer necessary for legal or business purposes. Federally, PIPEDA's Schedule 1 states the same principle (cl. 4.5, 4.5.2, 4.5.3). The two pressures stop conflicting once you split by record type: keep the decision trail, dispose of the report copy.
A schedule only works if the file is findable. Leasing in LetHub runs in its own system, not across five inboxes, so the application, the criteria in force that week and the decision sit together when a question arrives 18 months later. The retention period is still your call. Book a demo.
Frequently Asked Questions
How long must a landlord keep rental applications?
No federal rule sets a minimum for a private landlord. Two years past the decision is the defensible floor for the application, the written criteria and the decision itself, because 42 U.S.C. § 3613(a)(1)(A) allows a fair-housing civil action up to two years after the practice occurred or terminated. State and program rules can require longer.
Does the FCRA require you to keep screening reports?
No. The FTC Disposal Rule at 16 CFR § 682.3(a) requires reasonable measures to protect consumer information when you dispose of it, and § 1681m(a) requires an adverse-action notice to the applicant. Neither sets a retention period; turning either into one is a misreading.
Should you delete a rejected applicant's file right away?
Deleting early removes the evidence that your criteria were applied uniformly, which is what a fair-housing complaint asks about for up to two years under 42 U.S.C. § 3613. In British Columbia, PIPA s. 35(1) requires otherwise anyway: information used to make a decision must be kept at least one year.
What is the difference between retention and disposal?
Retention is how long you hold a record; disposal is how you destroy it. US federal law regulates the second for consumer reports and largely leaves the first to you. British Columbia's PIPA s. 35 does both — a one-year minimum after a decision, then a duty to destroy once the purpose ends.
