Your Landlord Wants a Passport Copy. Here's How Not to Regret It.

You found the apartment. It’s perfect — good location, reasonable rent, the kind of natural light that makes your morning coffee feel like a movie scene. The landlord seems nice. Then comes the email:

“Please send a copy of your passport and proof of income.”

And just like that, you’re about to send a stranger a photo of the most sensitive document you own.

I’ve done this more times than I can count. Three years as an expat in Spain, and I’ve sent passport copies to landlords, letting agents, property managers, banks, mobile providers, utility companies, and at least one gym that had no business asking. Every time, I scroll through thousands of photos on my phone, find the passport pic from six months ago (the one slightly blurry, at an angle, with my thumb in the corner), and send it via WhatsApp.

Everything on it. Document number. Date of birth. Photo. MRZ zone. Signature.

To someone I met twenty minutes ago.

Why this should make you uncomfortable

Your passport copy can be used to:

• Open bank accounts in your name
• Apply for loans or phone contracts
• Pass online identity verification (especially with deepfake tools)
• Create convincing forged documents

And landlords aren’t exactly Fort Knox when it comes to data security. Your passport scan might live in their email inbox forever, get forwarded to a property manager you’ve never met, printed and left on a desk, or stored on a shared Google Drive with password “landlord123.”

In Spain, the AEPD (data protection authority) fined hotels in 2025 for photocopying passports, ruling it violates data minimization principles. Hotels. The businesses that are supposed to check your ID.

If hotels are getting fined for it, your landlord probably shouldn’t be keeping an unredacted copy either.

What the landlord actually needs

Let’s break it down. A landlord asking for your passport usually wants to:

1. Verify you are who you say you are — they need your name and photo
2. Confirm your right to rent (in some countries) — they need nationality or visa status
3. Have a record for the contract — they need a copy of some kind

Notice what’s NOT on that list: your passport number, date of birth, MRZ zone, or signature. They don’t need those. Nobody checking if you’re a real person needs your machine-readable zone.

What to do instead

Step 1: Redact the sensitive fields.

Before sharing, black out:

• Passport/document number
• Machine-readable zone (those two lines at the bottom — they contain ALL your data in parseable format)
• Signature
• Date of birth (unless specifically requested)
• Any national ID numbers (BSN, SSN, NIE, etc.)

Step 2: Add a purpose watermark.

Stamp the copy with something like: “Copy for [Landlord Name] rental application — March 2026.”

This serves two purposes: it makes the copy useless if the landlord’s email gets compromised (nobody can use a passport stamped “for rental application” to open a bank account), and it creates accountability — if your data leaks, you know exactly who had it.

Step 3: Reduce the resolution.

Don’t send a 12-megapixel photo when a 2-megapixel one will do. Lower resolution = harder to use for fraud = still perfectly legible for verification purposes.

Step 4: Send it securely.

Signal > WhatsApp > Email. If you must use email, consider a service with expiring links (like Bitwarden Send or a similar tool).

”But what if the landlord refuses a redacted copy?”

This is the objection everyone worries about. In practice, it almost never happens. I’ve sent redacted copies to landlords across Spain and nobody has blinked. Why? Because they don’t need your passport number. They need to know you’re real.

If a landlord insists on an unredacted copy, that’s actually a red flag. A legitimate landlord verifying your identity doesn’t need your machine-readable zone. Ask them specifically which fields they need and why.

Under GDPR (if you’re in Europe), you have the right to provide the minimum necessary data. The landlord cannot collect more personal data than needed for the stated purpose.

The Dutch got it right

The Netherlands is one of the few countries that explicitly tells citizens how to share ID copies safely. From government.nl:

Make your BSN unreadable. Write on the copy that it is a copy. Specify the purpose.

They even made a government app for it (KopieID — Android only, last updated ages ago). The principle is right even if the app is dusty.

Make it a habit

Every time someone asks for a passport or ID copy — landlord, employer, hotel, utility company, gym — take 30 seconds to redact it first. It’s a small habit that protects you from a very large problem.

Your dream apartment is worth celebrating. Identity theft is not.