Fair Housing and Tenant Data Privacy: The Six Controls Property Management Firms Most Often Miss

Updated for 2026. Screening tools are now shipping AI-assisted scoring features that quietly broaden the fair-housing surface and import the same fair-lending concerns we cover in AI credit decisioning for mid-market lenders. Pair the six controls here with our AI trust accounting controls for property management before letting any vendor agent touch a tenant file. The two regulatory regimes that converge in the tenant file Most property management firms approach fair housing as a HUD problem and tenant data privacy as an IT problem, and the separation is the source of the recurring exposure. The two regimes converge in a single document, the tenant file, and an examiner working either regulatory angle pulls the same file and asks adjacent questions. The fair housing investigator wants to know what criteria the firm applied to deny an applicant and whether those criteria were applied consistently. The privacy regulator wants to know what data the firm collected on that applicant, what vendors processed it, how long it was retained after the application closed, and what the firm did to protect it. Both regulators arrive at the file. Both score the same artifact. The firms that survive both inquiries are the ones whose tenant file was built with both audiences in mind. The pattern across the engagements we have run is that the policy documents exist in nearly every firm. The screening policy is in the operations manual. The privacy notice is on the website. The accommodation procedure is in the leasing playbook. The breach plan is somewhere in the IT folder. What does not exist, with comparable consistency, is the evidence trail proving the policy was followed in the specific tenant interaction the regulator named. A clean policy with no evidence is the configuration that produces findings. This guide walks the regulatory frame, the six controls we cite most often in fair housing and tenant data privacy reviews, and the evidence pack that supports both regimes simultaneously. The audience is the broker/owner, the controller responsible for tenant data flows, and the IT lead supporting the property-management software stack. US-only; state divergence is meaningful in privacy and we name the active states throughout. The IT controls underneath this guide are covered in our M365 hardening field guide and our Azure security review method, those are the substrate; this guide is the application discipline that runs on top. The regulatory frame: HUD, FCRA, GLBA, and the state privacy stack The federal fair housing regime is the Fair Housing Act administered by HUD, which prohibits discrimination in housing on the basis of race, color, national origin, religion, sex (including gender identity and sexual orientation following the 2021 HUD memorandum), familial status, and disability. The enforcement vehicle is the HUD administrative complaint, the DOJ pattern-or-practice referral, and private fair housing organizations conducting matched-pair testing. Many states layer additional protected classes, source of income, age, marital status, military status, criminal history (in a growing number of jurisdictions), arrest record, citizenship status, and the state attorney general or state human rights agency runs parallel enforcement. The federal floor is the floor; the state ceiling is what the firm must operate to in any state where it manages property. The tenant screening regime sits primarily under the Fair Credit Reporting Act (FCRA), which governs how consumer reports are obtained, used, and disclosed. The FCRA's adverse-action notice requirement, the disclosure to the applicant when the screening report contributes to a denial, is one of the most consistently failed controls we audit. Beyond the FCRA, the Equal Credit Opportunity Act (ECOA) bears on adverse-action language, and several states have layered their own screening transparency laws (Washington, Oregon, California, Colorado, New Jersey) that require disclosure of the criteria, the screening vendor, and in some jurisdictions the right of the applicant to a copy of the report. The data privacy regime is multi-layered. The Gramm-Leach-Bliley Act (GLBA) applies to financial information collected in connection with the financial services elements of property management, security deposit handling, owner distributions, rent payment processing, and brings with it the Safeguards Rule, updated in 2023 to require a written information security program, designated qualified individual, risk assessment, access controls, encryption, multi-factor authentication, and incident response. Whether GLBA applies to a particular property management firm turns on the financial-services analysis; the engagements we have run typically conclude that GLBA applies to most residential PM firms above a modest scale, particularly those handling owner distributions and tenant payments through ACH rails. The state privacy stack varies materially. The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) imposes a notice-at-collection requirement, opt-out rights, deletion rights, and a private right of action for breaches of certain unencrypted personal information. The New York SHIELD Act imposes a reasonable-safeguards requirement on any business holding private information of New York residents. The Illinois Biometric Information Privacy Act (BIPA) governs biometric identifiers, fingerprint entry, facial recognition for property access, and carries a private right of action with statutory damages that have produced multi-million-dollar settlements. Texas, Virginia, Colorado, Connecticut, Utah, and a growing list of other states have enacted comprehensive privacy laws on a roughly CCPA-adjacent template. The PM firm that manages property in any of those states is exposed to the local regime. The breach notification layer adds another set of obligations. Every state has a breach notification law; thresholds, timelines, and definitions vary; the GLBA Safeguards Rule's 2023 amendment added a federal reporting requirement for incidents affecting 500 or more consumers; HUD has its own breach posture for federally subsidized housing. A PM firm operating across states is subject to the strictest applicable rule on each axis. The frame is complicated. The defense that holds across the complication is the evidence trail, the same set of artifacts answers questions from HUD, FCRA-claim plaintiffs, state attorneys general, and the firm's E&O carrier in materially similar form. Control 1: Screening criteria documentation The first control, and the one most often missing in a defensible form, is written documentation of the screening criteria the firm applies. The criteria as practiced exist; the criteria as documented frequently do not. A screening workflow that runs through a vendor's automated decisioning produces a result, and the result is recorded in the property management software, but the underlying rule the vendor applied, the credit-score threshold, the income multiple, the criminal-history lookback window, the eviction-history lookback, is configured in the vendor portal and never extracted into a firm-controlled artifact. The fair housing investigator's first question is not whether the criteria are reasonable. The first question is whether the criteria were applied consistently. Consistency requires that the criteria be written, that they be the same criteria the leasing agent applied across applicants on the property in the relevant period, and that any deviation be itself documented and justified. A firm with criteria in the vendor portal, criteria in the operations manual, and criteria the leasing agent verbally applies in the moment will produce three slightly different criteria. Investigators trained in matched-pair testing exploit precisely that gap. The control we recommend is a written screening criteria policy, dated and version-controlled, that names the credit threshold, income multiple, lookback windows, and individualized assessment requirements (particularly for criminal history under HUD's 2016 guidance and the growing number of state and local fair-chance housing laws), with a documented update process and a record of the version in effect on any specific application date. The vendor portal configuration matches the policy; deviations require documented exception approval; the leasing playbook references the policy rather than restating it. The artifact that proves the control is operating is the periodic, quarterly is a defensible cadence, reconciliation between the policy as written, the vendor configuration as set, and a sample of recent applications as decisioned. The reconciliation worksheet, retained in the firm's evidence pack, is the document that holds up under regulator scrutiny. Control 2: Screening vendor BAA and data-flow chain The second control concerns the chain of data agreements with the screening vendor. The firm receives applications containing sensitive personal information, social security numbers, dates of birth, employment information, banking details. The firm transmits some subset of that information to the screening vendor (TransUnion SmartMove, RentSpree, AppFolio Screening, Buildium Screening, RentPrep, others). The screening vendor in turn pulls consumer reports from credit bureaus, criminal-records aggregators, and eviction-records providers. The data flows downstream through additional sub-processors. The firm's contractual control over what those sub-processors do with the data ends at the contract with the primary vendor. The control gap we cite most often is that the firm cannot produce the current data processing agreement or business associate-equivalent contract with the primary screening vendor, the agreement is more than two years old and does not reflect current state privacy requirements, or the agreement does not specify the sub-processor chain. Under the GLBA Safeguards Rule's vendor oversight requirement and under most state privacy laws' vendor-management expectations, the firm is expected to maintain current agreements with named processors, conduct due diligence on their security posture, and document the oversight. The artifact that satisfies the control is a vendor inventory specific to the data flow, not the broader IT vendor inventory, but the inventory of every vendor that touches tenant or applicant personal information, with the contract status, the data-processing terms, the sub-processor disclosure, the most recent SOC 2 or equivalent attestation, and the breach-notification clause linked. The inventory is reviewed annually and on any vendor change. The annual review is documented. A related gap is the upstream side: the application form itself. Many PM firms collect more data than the screening vendor requires, store it in the property management system longer than necessary, and have no documented basis for the breadth of collection. The principle of data minimization, collect only what is necessary, retain only as long as necessary, is increasingly a state law requirement and is, in any case, the posture that limits the breach blast radius. Control 3: Advertising and listing review for protected-class language The third control is advertising review. The Fair Housing Act prohibits advertising that indicates a preference, limitation, or discrimination based on a protected class. The application of the rule is broad: a listing description that states "ideal for young professionals" implicates familial status; "Christian household preferred" implicates religion; "no Section 8" implicates source of income in the growing number of states and localities where source of income is protected. The rule extends to photographs, to the model used in marketing materials, to the social-media platforms the listing is posted on, and to the conversational responses leasing agents give to inquiry calls. The recurring exposure is the gap between the firm's centralized listing process and the decentralized reality of how listings actually go live. The marketing manager has approved language. The leasing agents post to Zillow, Apartments.com, Facebook Marketplace, Craigslist, and the firm's own site. The text drifts at each posting. The Facebook post includes language the marketing manager would not have approved. A fair housing tester captures the drift, and the complaint follows. The control we recommend is a centralized listing review workflow with a documented approval step, a written list of prohibited language including state-specific protected classes, and a periodic spot audit of live listings across the platforms the firm uses. The audit produces a sampled report, listing URL, language reviewed, finding, remediation, retained as evidence. We have observed firms that operate this discipline with a 30-minute monthly review session and produce the audit artifact alongside; we have observed firms that operate without it and produce the HUD complaint instead. A separate but adjacent control is the response script for inbound inquiry. A leasing agent asked over the phone "is this a quiet building or do families with kids live here" gives a response that is captured by the tester and by the firm's recording system. The response script, the language the agent is trained to use, is itself a control, and the training record proving the agent received the script is the evidence artifact. Control 4: Reasonable accommodation and modification request handling The fourth control concerns the handling of reasonable accommodation requests under the disability provisions of the Fair Housing Act. The statute requires the housing provider to make reasonable accommodations in rules, policies, practices, or services when necessary to afford a person with a disability equal opportunity to use and enjoy a dwelling. The recurring exposure is workflow: the request arrives in an unstructured form (verbal at the leasing office, an email to a property manager, a note appended to an application), the firm's response is also unstructured, and there is no consistent record of what was requested, how the firm engaged, what was offered, and what was ultimately approved or denied. The disability investigator's question is the procedural one: did the firm engage in the interactive process the regulation contemplates? The answer is yes only if the firm can show the request, the firm's response within a defined timeline, the dialogue around alternatives, the documentation of any requested verification (with attention to the narrow scope of permissible inquiry under the regulation), and the final disposition with reasoning. Without that record, the firm's defense is the leasing agent's recollection of a phone call from eight months ago. The control we recommend is a written accommodation/modification log, accessible in the property management software or in a dedicated case-tracking tool, with timestamped entries for receipt, acknowledgment, verification request (if any), engagement notes, decision, and notice to the requestor. The log is the evidence pack. Service-animal requests, modifications to the unit for accessibility, modifications to lease terms, modifications to common-area rules, all flow through the same workflow, all generate the same record structure. A second component of the control is staff training. The leasing agent who refuses a service animal because the property has a no-pet policy is a finding even if the firm's policy on its face permits service animals. The training record proving the agent received accommodation training, the date of the training, and the content covered is the evidence the regulator will ask for. Control 5: Tenant data retention and disposal The fifth control concerns retention. Tenant and applicant files accumulate in property management systems indefinitely unless an active disposal workflow runs. The retention requirement under fair housing record-keeping rules is typically two to three years for application records (HUD's posture), longer for tenancy records, longer still where state law layers an extended retention requirement (California's seven-year lease retention; specific state requirements for security deposit records). The privacy-side requirement runs in the opposite direction: data should be retained no longer than necessary for the purpose collected, and once the purpose has ended, the data should be disposed of through a defensible process. The configuration we encounter most often is no retention policy at all. Applications from 2017 sit in the property management system in 2026. Screening reports from 2019 are still attached to applicant records that never converted. The data is the breach surface: an attacker who compromises the property management software gains access to a decade of personal information that the firm had no continuing reason to hold. The control we recommend is a written retention schedule that names, by data category, the retention period, the trigger event, and the disposal method. The schedule maps to the property management software's data fields, the document storage system, the email archive, and any third-party tools that hold tenant data. A periodic disposal cycle, quarterly at minimum, monthly for high-volume firms, runs against the schedule and produces a disposal log. The disposal itself must be defensible. Soft-delete in the property management software is not disposal if the data remains recoverable. Retention of data in vendor backups beyond the firm's own retention period is itself a gap. The vendor inventory from Control 2 informs the disposal scope: the firm cannot dispose of what the vendor retains under its own contract. The CCPA/CPRA, Virginia's CDPA, Colorado's CPA, and an expanding list of state laws give consumers a right to deletion that overlays the firm's own retention schedule. The workflow that responds to a deletion request, verifying identity, locating the data across systems, executing the deletion, documenting the response, is itself a control, and it is one we cite frequently as missing in firms that have not yet had a request to test the workflow. Control 6: Breach notification and incident response posture The sixth control is the breach posture. The firm's incident response plan exists in some form in nearly every audit. The plan that has been tested, that names the qualified individual under the GLBA Safeguards Rule, that maps to the state-by-state notification timeline matrix, and that connects to the cyber insurance policy's notice provisions exists in materially fewer firms. The recurring gap is the multi-state notification matrix. A firm holding tenant data on residents of fifteen states has fifteen breach notification regimes to navigate in the event of an incident. The timelines run from "without unreasonable delay" to a 30-day hard cap to a 60-day cap, and the definitions of personal information and the thresholds for notification vary materially. A firm operating without a pre-built notification matrix will spend the first 72 hours after detection assembling the matrix rather than executing the response. The control we recommend is a written incident response plan that covers detection, containment, eradication, recovery, and notification, mapped to the regulatory regimes the firm is exposed to (the state breach notification laws, GLBA Safeguards Rule reporting, HUD-specific reporting if subsidized housing is in scope, cyber-insurance carrier notice). The plan names roles by title rather than by individual to survive turnover. The plan is tested at least annually through a tabletop exercise that produces a written after-action report and remediation list. The qualified individual under the GLBA Safeguards Rule is named and has the seniority and budget access the rule contemplates. The IT controls that underpin breach defense are covered in detail in our M365 hardening field guide and our Azure security review method. The discipline of running the controls is what generates the evidence; the evidence is what defends the firm in the post-incident regulatory and civil exposure. How the six controls produce a single evidence pack The exposure surface across fair housing and tenant data privacy is broad, and the temptation when responding to it is to build six separate compliance programs that report up through six different owners. The discipline that holds across the engagements we have run is the opposite: the six controls produce overlapping evidence, and a single evidence pack, refreshed quarterly, retained centrally, accessible to the broker, the IT lead, and outside counsel, answers regulator questions in any of the six domains. The evidence pack structure we recommend has six sections paralleling the six controls: the screening criteria policy and reconciliation worksheet; the vendor inventory and data-processing agreement chain; the listing review log and prohibited-language list; the accommodation case log and training record; the retention schedule and disposal log; and the incident response plan, qualified-individual designation, and most recent tabletop after-action report. Each section is dated. Each section names the owner. Each section retains at least the prior twelve months of activity. When the HUD complaint arrives, sections one, three, and four answer it. When the state attorney general's privacy inquiry arrives, sections two, five, and six answer it. When the cyber-insurance underwriter renews, all six are evidence the renewal references. When the firm acquires another portfolio (we cover the back-office side of that integration in our PM M&A field guide), the evidence pack is the artifact diligence reviews on day one. One pack, multiple audiences, recurring refresh. What we recommend Begin with a six-control gap audit against the firm's current state. The audit is binary at the artifact level: for each of the six controls, does the firm hold the document the regulator would ask for, dated within the last twelve months, with named ownership and retained history? Most mid-market PM firms we have audited hold defensible evidence on two of the six. The remaining four are the work plan. Second, designate the qualified individual under the GLBA Safeguards Rule by name, by title, with the role description in writing, and with documented access to the firm's leadership. The designation is itself a regulatory artifact and is the easiest one to put in place. Third, build the vendor inventory specific to tenant and applicant data. The inventory is the foundation for the data-processing agreement chain, the retention schedule, and the breach notification matrix. Without it, every other control runs on incomplete information. Fourth, run the listing review and the accommodation case log as recurring monthly disciplines. Both are the controls most easily backfilled with a recurring cadence and the controls most often cited in matched-pair testing or disability-rights enforcement. Fifth, schedule the breach tabletop. The first tabletop will surface gaps in the plan, the matrix, and the named roles. The second tabletop will be materially shorter. The third tabletop will produce a confident response posture. Fair housing and tenant data privacy do not come down to two regulatory regimes. They come down to a single evidence pack covering six controls, refreshed on a known cadence, owned by a named individual, and accessible when the inquiry arrives. Build the pack now, in clean operational time. The cost of building it under regulatory pressure, when the discovery deadline is already running, is materially larger.