Renting property for profit is commercial activity. The moment you take an application, you are an organization collecting personal information under Canadian privacy law, with no small-landlord exemption.

Alberta's privacy commissioner puts it plainly: the province's private sector privacy act covers any residential property owner renting out all or part of their property.

Most landlord application forms ask for more than the law permits and less than the decision requires. Here is the form worth using.

Which law applies to you

Alberta and British Columbia run their own provincial Personal Information Protection Acts. Ontario and everywhere else outside Alberta and BC fall under PIPEDA, the federal act.

The obligations run parallel. Identify why you are collecting before you collect. Get consent. Collect only what is reasonably necessary to decide whether to rent to this person. Keep it only as long as you need it. Destroy it so it cannot be reconstructed. Give the applicant access on written request, within 30 days under PIPEDA and 45 days under Alberta's act.

The operative phrase is reasonably necessary. Every field on your form has to earn its place against the standard.

What to collect

• Identity — full legal name, date of birth, current address, phone, email. Date of birth belongs here because it is the standard credit-check identifier and the lawful alternative to a Social Insurance Number.
• Occupancy — number of occupants and their names, requested move-in date, and pets described by type and number, phrased in line with your province's rules.
• Income and employment — employer name, position, length of employment, and a supervisor or HR contact; gross monthly income; for self-employed applicants, a notice of assessment or two recent months of business records.
• Rental history — the last two addresses, with dates, rent paid, and landlord name and contact; reason for leaving.
• References — two, ideally the current and previous landlord rather than personal friends.
• Consent — a clear, specific authorization block.

The list above is the entire defensible form. It fits on two pages.

What to leave off

Social Insurance Number is the field to remove today. The federal privacy commissioner's position: unless an organization demonstrates the SIN is required by law, or shows no alternative identifier would complete the transaction, you cannot deny a product or service because someone refuses to provide it. A SIN is not required for tenancy, and it is not required for a credit check. Name, address and date of birth are sufficient.

Alberta's commissioner goes further and says landlords should avoid collecting a SIN at all. The federal commissioner's guidance for the rental sector says do not request it, and if you do, mark it clearly optional. If an applicant refuses, proceed without it — the refusal is not a lawful basis for rejection, and one property management company amended its form to make the field optional after a federal privacy investigation.

• Photocopies of identification — viewing a licence to confirm identity is generally acceptable; photocopying and keeping it is hard to justify where viewing does what you need.
• Full bank statements — Alberta's commissioner limits financial collection to what is reasonably required to process rent payments. A full statement exposes transaction-level information about the applicant and third parties — a pay stub or employment letter is the proportionate ask.
• Social media accounts — BC's commissioner describes social media checks as almost never authorized.
• Marital status, family plans, citizenship, first language, place of origin — these touch protected grounds and buy you nothing. Our human rights obligations post covers the reasoning.

Wording the consent clause

A vague clause is not consent. A federal investigation found an application clause broadly authorizing credit reports and any other information deemed necessary failed the standard.

Consent has to be specific about what you will collect, from whom, and why. Something along these lines: "I authorize [landlord name] to obtain a consumer credit report from a registered consumer reporting agency, to contact the employers and landlords named on this application, and to verify the information provided here, for the sole purpose of assessing my application to rent [address]. I understand this information will be retained for [period] and then securely destroyed, and I have the right to request access to my file in writing."

Adjust for your province and add public-record searches explicitly if you intend to do them. A purpose you did not name is a purpose you did not get consent for.

One form, one inbox

The compliance argument for standardizing the form is strong. The operational argument is stronger.

Every applicant answering the same questions in the same order gives you a comparable set. Free-text emails and phone calls give you an unsortable pile and a decision you cannot explain later.

• Set a closing time, stated at every showing and in the listing — applications close Sunday at 8 p.m.
• Review as a batch, not first come first served — reviewing in arrival order feels fair and is not, because it rewards whoever was free the afternoon it posted.
• Score against written criteria you set before you advertised.
• Log every application and every outcome — the reason for the decision, in one line, recorded the day you make it.

Retention and disposal

This is the part almost nobody does, and it is a live obligation.

• Keep the successful applicant's file for the length of the tenancy plus the limitation period in your province — it becomes part of the tenancy record.
• Keep unsuccessful applications long enough to answer a human rights or privacy complaint, and no longer — one year is a defensible period in most cases. Write your period down and apply it consistently.
• Destroy securely — shred paper, delete digital files including the copies sitting in your email attachments folder, your phone's photo roll and your downloads directory. A file destroyed from your filing cabinet but living in your inbox has not been destroyed.
• Do not build a list — a federal investigation into a property management company's "bad tenant list" found it amounted to unlicensed consumer reporting, the consent was invalid, and tenants had no way to access or challenge entries. The same reasoning reaches informal landlord groups sharing names.

The short version

Collect identity, occupancy, income, rental history, references and consent. Leave off the SIN, the ID photocopies, the full bank statements and anything touching a protected ground. Word the consent clause specifically. Set a retention period and run it.

A form built this way is faster to review, easier to compare, and survives a complaint. Those are the same form.

LuxOasisOS runs one standard application into one inbox, with the same fields and the same record for every applicant, and screening reports attached to the file rather than scattered across email.