GDPR and self storage: practical compliance checklist

The General Data Protection Regulation (GDPR) applies to every self storage operator in Europe that collects, stores or processes personal data — and that means virtually every operator. From customer names and addresses to access logs and payment records, self storage businesses handle significant amounts of personal information daily. Yet many operators remain uncertain about their obligations and whether their current practices meet the requirements.

This article provides a practical, actionable checklist specifically tailored for self storage operations. It is not a legal opinion — for that, consult a data protection specialist — but it covers the key areas where self storage businesses need to get it right.

What personal data do self storage operators collect?

Before you can protect personal data, you need to understand what you collect. Self storage operations typically handle the following categories of personal information:

• Identity data — Names, addresses, dates of birth, copies of identity documents (if required for verification).
• Contact data — Email addresses, phone numbers, postal addresses.
• Financial data — Bank account numbers, payment card details (typically processed by payment providers like Mollie), transaction histories.
• Access data — Logs of when customers entered and exited the facility, which units were accessed, PIN codes, app usage data.
• Communication data — Email correspondence, chat transcripts (including with AI sales assistants), phone call records.
• CCTV footage — Camera recordings at the facility entrance, corridors and common areas.
• Contract data — Rental agreements, insurance details, terms and conditions acceptances.

Most operators are surprised by how much personal data they actually collect. Mapping this data is the essential first step towards compliance.

The GDPR compliance checklist for self storage

Work through each of these areas systematically. If you can answer "yes" to every point, your operation is well-positioned for GDPR compliance.

1. Lawful basis for processing

• Have you identified the lawful basis for each type of data processing (contract performance, legitimate interest, consent)?
• Do you collect only the data that is strictly necessary for the stated purpose (data minimisation)?
• If you rely on consent, is it freely given, specific, informed and unambiguous?
• Can customers withdraw consent as easily as they gave it?

2. Transparency and information

• Do you have a clear, accessible privacy policy that explains what data you collect, why, and how long you keep it?
• Is the privacy policy written in plain language (not legal jargon)?
• Do you inform customers about data collection at the point of collection (booking forms, access registration, CCTV signs)?
• If you use cameras, are signs clearly visible before customers enter the recorded area?

3. Data storage and security

• Is personal data encrypted both in transit and at rest?
• Is data hosted within the European Economic Area (EEA)?
• Do you have access controls that limit who within your organisation can view personal data?
• Are your software providers (management system, payment processor, email service) GDPR compliant?
• Do you have data processing agreements (DPAs) in place with all third-party processors?

4. Data subject rights

• Can you respond to a subject access request (SAR) within 30 days?
• Can you export all personal data you hold about an individual in a portable format?
• Can you delete all personal data about a customer when they exercise their right to erasure?
• Do you have a process for handling objections to data processing?
• Can you restrict processing of specific data upon request?

5. Data retention

• Have you defined retention periods for each category of personal data?
• Is data automatically deleted or anonymised when the retention period expires?
• Are CCTV recordings deleted after a defined period (typically 30 days unless needed for an incident)?
• Are access logs purged after they are no longer needed for security or contractual purposes?

6. Breach response

• Do you have a documented data breach response procedure?
• Can you notify the relevant supervisory authority within 72 hours of discovering a breach?
• Can you notify affected individuals without undue delay if the breach poses a high risk to their rights?
• Do you maintain a log of all data breaches, even minor ones?

European-hosted software: a practical advantage

One of the most straightforward ways to simplify GDPR compliance is to choose software that hosts data within the EU. When your management software, payment processor and email service all operate within the European Economic Area, you avoid the complex legal mechanisms required for international data transfers.

The EU-US Data Privacy Framework provides a legal basis for transatlantic transfers, but its long-term stability remains uncertain — previous frameworks (Privacy Shield, Safe Harbor) were invalidated by the Court of Justice. European-hosted solutions eliminate this risk entirely.

MyYounit hosts all data within the EU and processes payments through Mollie, a Dutch payment service provider. This means your customer data never leaves European jurisdiction, simplifying your compliance obligations significantly.

CCTV and access control: specific considerations

Self storage facilities present unique GDPR challenges because of the combination of CCTV surveillance and electronic access control. Both systems collect personal data, and both require careful handling.

CCTV. You need a clear lawful basis for recording — typically legitimate interest in security. Cameras must not record inside individual storage units (that would be disproportionate). Signs must inform visitors before they enter the recorded area. Footage should be stored for the minimum period necessary, and access to recordings should be restricted to authorised personnel.

Access logs. Electronic access control systems create detailed logs of who accessed the facility and when. These logs serve legitimate security purposes, but they also constitute personal data. Define a retention period for access logs, restrict who can view them, and ensure they are included in any subject access request.

Practical steps to get started

If your current compliance posture is unclear, start with these steps:

• Conduct a data audit — Map every piece of personal data your operation collects, where it is stored, who has access and how long it is retained.
• Review your software stack — Check whether your management system, payment provider, email service and access control system are GDPR compliant. Request DPAs from each provider.
• Update your privacy policy — Ensure it accurately reflects your current data practices and is easily accessible on your website and in your booking flow.
• Train your team — Anyone who handles personal data needs to understand the basics of GDPR. This includes front-desk staff, managers and IT personnel.
• Appoint a responsible person — Even if you are not required to appoint a formal Data Protection Officer (DPO), designate someone within your organisation as responsible for data protection matters.
• Document everything — GDPR requires accountability. Document your data processing activities, your lawful bases, your retention periods and your breach response procedures. If the regulator comes knocking, documentation is your first line of defence.

GDPR compliance is not a one-time project — it is an ongoing obligation. But with the right management software and clear internal processes, it does not need to be burdensome. Operators who get this right protect both their customers and their business.