Your Landlord Photocopying Your Passport Isn't a Formality — It's a GDPR Violation

I've lost count of how many people tell us the same story. They find a room in Utrecht or Groningen, the agent says "stuur even een kopie van je paspoort ter verificatie," and within minutes a full scan — photo, signature, MRZ code, BSN and all — is sitting in a WhatsApp thread with a stranger they met twenty minutes ago on a viewing.

Everyone treats this as standard procedure. It's presented as though it's a legal requirement, on the same level as signing a lease or paying a deposit. It isn't. And the fact that it's normalized doesn't make it legal.

The Autoriteit Persoonsgegevens (the Dutch data protection authority) has been explicit on this point: making a full copy, scan, or photo of someone's ID is only allowed if there's a specific legal basis for it. Landlords renting out a room do not have that legal basis. Verification, yes. Retention of a full copy, no.

Dutch law requires landlords to verify who they're renting to — partly because of anti-money laundering rules, partly because of municipal registration obligations. Verification means looking at your ID and noting down the type of document, the document number, your name and date of birth. That's it.

It does not mean scanning your passport photo, your signature, or your Burgerservicenummer (BSN). The AP's own guidance draws this line clearly: a landlord can check your identity document, but making and keeping a full copy requires a specific legal obligation — and 'renting an apartment' isn't one of the situations where that obligation exists.

Compare that to what banks or employers are legally required to do, where a copy is sometimes mandated by law. A landlord in Rotterdam renting out a kamer is in a completely different legal position, even if the paperwork on their desk looks identical.

The obvious counter is: "but I agreed to it." Under GDPR and the Dutch UAVG, consent only counts as a valid legal basis if it's freely given. In a housing market where five people are competing for one room in Amsterdam or Delft, agreeing to hand over your passport isn't free choice — it's compliance under pressure. You say yes because saying no might cost you the room.

That power imbalance is exactly why GDPR guidance treats consent skeptically in situations like rental applications and employment. The tenant isn't negotiating from an equal position, so 'I said it was fine' doesn't carry the legal weight landlords assume it does.

Here's the part that gets lost in the 'just a formality' framing: the person who takes on the risk when a passport copy leaks isn't the landlord. It's you.

A full digital passport scan has real value on the black market — research from Comparitech put the average price at around $14.71, rising to $61.27 when it's bundled with other proof of identity. Multiply that by the number of landlords, agents, and random Facebook Marketplace 'verhuurders' who've collected a copy of your passport over a year of apartment hunting in the Netherlands, and you start to see the exposure.

And it's not hypothetical. Every year the Dutch government runs public warnings about ID copies being reused to open bank accounts, take out loans, or register phone contracts in someone else's name. If your scan sits in an agent's unsecured Gmail inbox or a shared Google Drive folder — which, anecdotally, is exactly where a lot of these end up — you have no idea who else can reach it, or for how long.

The Netherlands isn't the only country wrestling with this. In June 2026, Greece's data protection authority ruled that hotels and rental operators can no longer photocopy or photograph guests' ID documents or payment cards at all — verification is fine, retention is not. Spain and Germany run similar systems: hotels and landlords register specific fields (name, date of birth, nationality, document number, stay dates) without ever scanning the whole document.

Enforcement isn't just theoretical there either — Spanish authorities have fined hotels up to €45,000 for holding onto passport scans longer than legally allowed or failing to secure them properly. The direction across Europe is consistent: less data collected, shorter retention, tighter security. The Netherlands, with one of the stronger privacy law traditions in the EU, is lagging behind its own standards on this specific practice.

You don't need to refuse outright — that can genuinely cost you a room in a market this tight. But you can push back on what's being requested.

If a landlord or agent asks for a copy, ask them to explain the specific legal basis. Most won't have an answer beyond "we always do this." You can point them to the AP's own guidance on ID copies, which is public and in Dutch and English.

If a copy really is unavoidable — some municipalities or specific contract situations do require it — use a tool like KopieID to black out your BSN, photo, and signature before handing anything over. It's a free app from the Dutch government built exactly for this problem.

And if you believe your data has already been mishandled — sent around insecurely, kept longer than needed, or shared with parties who had no reason to have it — you can file a complaint directly with the Autoriteit Persoonsgegevens. It costs nothing and it's the mechanism that actually holds agents accountable, rather than just grumbling about it in a Facebook group for internationals in Amsterdam.