"You can't ask for that before the viewing": what the law really says, in Europe

"You can't ask for that before the viewing": what the law really says, in Europe

Wherever we speak to estate agencies, the same objection comes back: in Europe, a professional cannot demand a candidate's financial information before the property viewing. That's correct, and we don't dispute it. But this rule governs what the agency requests, not the approach of a candidate who compiles their file and chooses to share it. The distinction holds across the seven countries where Immotecto operates, on one condition that we prefer to spell out in black and white.

The rule governs the agency's request, not the candidate's approach

When it's the agency or landlord who requests documents in a rental procedure, the timing and content are regulated. Before the viewing, generally only a name and contact details can be requested. It's only afterwards, at the selection stage, that proof of income can be sought.

The case of a portal is different. Here, it's not the agency requesting. It's the candidate who, on their own initiative, builds their file and decides to present it. This shift, from the landlord-candidate relationship to the portal-user relationship, is real. But it doesn't make the law disappear: above national rules, a common text applies across all seven countries, the GDPR. It requires that any data collection remains proportionate to its purpose. The right formula is therefore never "nothing applies", but rather "nothing prohibits a file proportionate to its purpose".

This principle is already enforced by several states

What's most striking is that "the candidate provides their own data" isn't a trick we invented. It's the mechanism that several national laws explicitly require.

• In the Netherlands, in response to parliamentary questions about the 2023 Good Landlord Act, the government writes that income data "must be provided by the tenant themselves", and that by providing it, the tenant consents to its processing.
• In Germany, the landlord cannot query SCHUFA or an equivalent organisation themselves. It's up to the candidate to produce their own certificate. German law therefore structurally requires that the candidate provides the proof.
• In Belgium, the data protection authority has recognised since 2009 that candidates "sometimes spontaneously submit" their documents to maximise their chances.

Three states, three ways of saying the same thing: it's up to the candidate to compile and control their file. That's exactly the architecture of Immotecto. The candidate builds their TectoDossier, obtains their TectoPass, and chooses to present it.

Better still: states have built their own file portals

Two countries don't just recognise the principle, they've implemented it themselves.

In France, the state created DossierFacile, a free public service where candidates compile their digital rental file, have it verified, then share it via a secure link. In Luxembourg, RENLA allows candidates to register and submit their documents online via MyGuichet.lu, in the affordable housing segment.

The digital tenant file model compiled by the candidate is therefore not a grey area. It's already supported by public authorities. We position ourselves in the same logic, with an added layer of payment reliability.

The European tour, in brief

• Belgium (active market): three regional regimes (Flemish Woninghuurdecreet, Brussels Housing Code with legal three-stage timeline, Walloon decree with list of eight data points). The DPA recognises spontaneous provision, whilst reminding that this never exempts from GDPR.
• France (active market): the 2015 decree sets a limited list of documents that landlords may require, subject to fines. A raw bank statement does not appear on it, and that's a point we scrupulously respect.
• Germany: no fixed legal list, but guidance from data protection authorities, updated in 2026, which structures the process in three phases and entrusts proof to the candidate.
• Spain: the legal basis for processing data necessary for the lease is contract execution. The authority emphasises minimisation, as a complete payslip contains far more than what is useful.
• Portugal: no detailed sectoral doctrine, but the common GDPR foundation applies in full, as everywhere in the Union.
• Netherlands: the 2023 law requires a transparent and non-discriminatory selection procedure, and entrusts the candidate with providing their income data.
• Luxembourg: no list as detailed as France's, the minimisation principle governs, and the public RENLA shows that the file compiled by the candidate is a recognised model.

The only red line, the same everywhere: proportionality

It would be dishonest to stop at the reassuring observation. The fact that a candidate provides their documents themselves doesn't "automatically" make the collection compliant. The Belgian regulator says it word for word, and the logic applies across all seven countries.

We fully accept this. Immotecto is a data controller within the meaning of GDPR. As such, we guarantee a specific purpose, data minimisation, a clear legal basis, short retention periods and fully exercisable rights. The TectoPass remains focused on what serves its purpose, because an accumulation of otherwise harmless data can cease to be proportionate.

A point of vocabulary that isn't cosmetic: everywhere, only the amount of income is relevant, never its nature or source. Excluding a candidate because they receive replacement income, unemployment benefit, social assistance, or pension, is discriminatory in all seven countries. That's why Immotecto measures actual payment reliability, not a type of income. We don't do credit scoring and pass no judgement on the origin of a person's income.

We're sometimes compared to opening a bank account, where you're asked for ID. The image is useful but deserves clarification. The bank has a legal obligation to collect these documents. A rental portal has no such obligation. The right formula is therefore simple: just as an online service can ask its users to verify their identity, a portal can ask them to compile a tenant file, provided that file remains proportionate to its purpose.

What we never do: give access to your accounts

To establish a real payment history, the most reliable route is bank connection via Open Banking, governed by the European PSD2 directive and operated by an authorised provider. The data comes directly from the bank, under strong authentication, which eliminates the risk of fake documents.

Here's the decisive nuance, and it makes the difference between compliant and non-compliant, particularly in the Netherlands where the authority has explicitly stated it. An agency never receives access to the candidate's accounts, nor their statements. The candidate generates a proof of payment reliability and shares only that proof. The connection remains optional, with a genuinely usable alternative pathway, and consent is revocable at any time. Without these safeguards, consent wouldn't be "freely given" within the meaning of GDPR, and we don't want it any other way.

What an agency can take away from this

The initial objection is valid, and we prefer to acknowledge it rather than sidestep it. The "no financials before the viewing" rule governs what the agency can request. It doesn't regulate a file that a candidate has compiled and chosen to share, provided the platform respects GDPR end-to-end. That's what we do, across all seven countries.

Our position isn't "we have the right despite the rules". It's more solid than that: we're aligned with what regulators, and even some states, already require, namely that it's the candidate who compiles and controls their file. An agency consulting a TectoPass is looking at verifiable information, focused on payment reliability, without ever crossing the line into discrimination.