Sector

Self-storage: destroying customer contracts and data

25 July 2026 · 10 min read · DeSnipperaar

A self-storage business rents out space, but in doing so processes a stream of personal data: rental contracts, name and address, an ID copy when the rental begins, payment data, CCTV footage at the units and sometimes abandoned belongings with documents from departed customers. Part falls under the tax retention obligation, part you keep until the rental is settled, and part should be kept as briefly as possible. This guide shows, by part, what you keep, when it may go and how to destroy it confidentially.

The quick answer: the invoicing falls under the tax seven years, the rental contract you keep as long as the rental runs and until disputes are settled. ID copies and CCTV footage you keep as briefly as possible. What may go disappears confidentially and with a certificate.

Two frameworks: rental agreement and GDPR

At a self-storage business two things run together. The rental agreement and the administration bring a retention obligation, of which the invoicing falls under the tax seven years. Alongside this the GDPR applies, which requires not keeping personal data longer than necessary. The retention obligation sets the floor for what you must keep, the GDPR the ceiling for what you may not keep too long.

So treat the customer data per type. A running rental contract has a different status than an ID copy from the past or a CCTV image from last week. If you make that distinction, you keep exactly what you must and clear out the rest on time.

Retention periods by part

The period differs per type of data. The overview below gives the main line. Count the tax period from the end of the financial year and the other periods from the end of the rental.

Part	Starting point	Period
Invoicing and administration	Tax retention obligation	7 years
Rental contract	Until settlement of the rental	term + dispute period
Tenant ID copy	As limited as possible	only what is needed
CCTV footage at the units	Storage limitation	usually a few weeks
Abandoned documents	Not yours, no ground	clear out confidentially
Correspondence and drafts	No retention obligation	clear out at once

Use this as a guideline, not a substitute for your own legal check. When in doubt, consult your lawyer or privacy adviser. A complete overview is in the GDPR retention periods cheatsheet.

ID copy at rental: be restrained

Many self-storage businesses ask for an identity document when the rental begins. That is allowed to identify the tenant, but that does not mean you may keep a full copy of a passport. A passport copy contains a national ID number, a photo and more than you need, and is therefore sensitive. Note only the data you really need and do not keep single copies longer than necessary. Whatever you did have on paper you clear out confidentially.

That way you avoid managing a mountain of identity data you did not actually need. How to handle an ID copy safely is set out in safely destroying passport and ID copies.

Abandoned belongings and documents after non-payment or termination

When a tenant terminates or stops paying, belongings sometimes remain in the unit. Among those items there are regularly documents with personal data, from old administration to moving boxes full of papers. For the items themselves you follow the procedure from the rental contract and the law for abandoned property. For the documents the rule is that you may not throw them uncontrolled into the paper bin, because that risks a data breach.

Collect the papers you come across separately in a sealed container and have them destroyed confidentially. The same applies to documents that remain after a move or clearance of a unit. The approach resembles that of an office move, where unexpectedly much paper also surfaces.

CCTV footage at the units

Camera surveillance at the corridors and units is common in the sector. CCTV footage is personal data, so the storage limitation applies here too. Do not keep the footage longer than necessary for security, usually a few weeks, unless a concrete incident justifies longer retention. Old storage drives and recorders with footage do not belong unwiped with the waste. More on periods and wiping is in CCTV footage: retention and destruction.

How to handle it in 6 steps

1. Split the data into administration, contracts, ID copies and CCTV footage.
2. Limit ID copies to what you need to identify the tenant.
3. Clear out contracts once the rental and any disputes are settled.
4. Wipe CCTV footage after the set period and secure the storage.
5. Collect abandoned documents in sealed containers, not in the paper bin.
6. Have it destroyed confidentially with a certificate and record it in your register.

Destroy confidentially with a certificate

Customer data is destroyed confidentially, because it contains identity, contract and payment data. The paper and any data carriers travel sealed and stay that way until destruction, so the chain is closed. An old office computer, backup or camera recorder with customer data belongs with it too. For a large one-off batch, for instance after clearing out an archive, a one-off archive destruction is the logical choice.

Afterwards you receive a certificate of destruction with the date, quantity and level. That certificate is your proof towards the GDPR that you acted carefully. We collect within 20 km of Amsterdam with no call-out charge, work nationwide through pooled collection rounds and charge a fixed price per box or roll container. Drop-off on site is not possible; it works by appointment through collection.

Common mistakes

• Keeping ID copies indefinitely. Note only what you need to identify the tenant.
• Keeping contracts forever. After settlement and the tax period the purpose lapses.
• Throwing abandoned documents in the paper bin. Those need confidential destruction.
• Keeping CCTV footage too long. Wipe it after the set period.
• Keeping no proof. Without a certificate you cannot demonstrate the destruction.

Frequently asked questions

How long does a self-storage business keep rental contracts?

The invoicing around the rental contract falls under the seven-year tax retention obligation. The contract itself you keep as long as the rental runs and until any disputes are settled. After that the ground lapses and you clear it out confidentially.

May I keep an ID copy of a tenant?

Be restrained here. A copy of a passport contains a national ID number and a photo and is sensitive. Note only what you need to identify the tenant and do not keep a full copy longer than necessary.

What do I do with abandoned belongings and documents after non-payment?

Follow the procedure from the rental contract and the law for abandoned property. Documents with personal data you come across you do not throw away uncontrolled. You collect those separately and have them destroyed confidentially.

How do I destroy customer data in line with the GDPR?

Confidentially and with a certificate of destruction. Paper and data carriers travel sealed and the destruction is recorded in the record of processing.

Conclusion

A self-storage business works with identity, contract and payment data of every tenant, supplemented by CCTV footage and sometimes abandoned documents. Keep the administration seven years, clear out contracts after settlement and be restrained with ID copies. CCTV footage you wipe after the set period and abandoned papers you collect separately. What may go you have destroyed confidentially with a certificate as proof. That way you meet both frameworks and protect your customers' data.

Read also: property managers: destroying tenant files, installation companies: destroying customer data, engineering firms: destroying project files and the GDPR retention periods cheatsheet.

---

Have customer data collected? Request a quote via desnipperaar.nl. Within a few minutes you have a fixed price, including a certificate as proof.

Also relevant: Equipment rental: destroying contracts and customer data.