Legal Basis for Processing Data in a Condominium

In a condominium, owners' data is almost never processed on the basis of consent. In most cases the correct legal basis is compliance with a legal obligation or the performance of management activities, with legitimate interest as support for related purposes. Identifying the exact legal basis, among the six set out in Article 6 of EU Regulation 2016/679, is the first step toward lawful processing and a credible privacy notice.

Why consent is rarely needed

Consent is only one of the six legal bases in Article 6 GDPR, and for the condominium manager it is often the worst. Consent means the data subject can withdraw it at any time, but the manager cannot stop processing an owner's name, thousandths (millesimi) share or contact details simply because that owner withdraws consent, since those data are required by law for management. Basing a mandatory processing operation on consent would make it fragile and contradictory. Consent remains appropriate only for genuinely optional purposes, for example sending communications that are not necessary for management.

Legal obligation: the main basis

Many condominium processing operations respond to a legal obligation of the manager, and therefore find their basis in Article 6(1)(c) GDPR. Article 1130 of the Italian Civil Code requires the manager to keep the condominium register with the details of individual owners and holders of real and enjoyment rights, cadastral data and contact details. The same applies to keeping minutes, accounting records and collecting contributions. These data must be processed regardless of the individual's will, because the law requires it.

• Condominium owners register (Art. 1130 no. 6 Italian Civil Code)
• Keeping accounts and allocating expenses
• Collecting contributions and recovering arrears
• Mandatory communications and calling the owners' meeting (Art. 66 implementing provisions)

Performance of a contract or relationship

Some processing serves to perform a relationship to which the data subject is a party, and is based on Article 6(1)(b). This covers the data of suppliers with whom the condominium has signed a maintenance, cleaning or insurance contract, and data needed to manage the relationship with the manager. Here too consent is unnecessary: the processing is the condition for the contract to work. It must still be limited to the data actually needed for performance, without collecting further information.

Legitimate interest: when and how

Legitimate interest, under Article 6(1)(f), covers purposes tied to condominium life that do not stem from a specific obligation but are reasonable and expected, provided the rights and freedoms of data subjects do not prevail. This typically includes video surveillance approved by the owners' meeting for the security of common areas and the ordinary handling of useful communications among owners. Anyone relying on legitimate interest should document a balancing assessment, the so-called legitimate interest test, showing the proportion between the purpose pursued and the impact on privacy. The data subject retains the right to object.

The role of the 2025 Garante guidelines

With its measure of 10 April 2025, the Italian Data Protection Authority (Garante) began updating the guidelines on the processing of personal data in condominiums, published for consultation in Official Gazette no. 106 of 9 May 2025. The document reaffirms that processing must rest on a clear legal basis proportionate to the purposes of collective management of common areas, and clarifies the relationships among condominium, manager and suppliers. Updating the privacy notice in light of this framework is now good practice for every firm.

Special categories: watch out for sensitive data

If data revealing health status emerges, for example for removing architectural barriers or for benefits, you enter the field of special categories under Article 9 GDPR, which requires a reinforced legal basis and stricter protection. Such data must be processed only when strictly necessary, stored separately and made accessible to the fewest possible people. A common mistake is circulating in the owners' meeting or on the notice board information that reveals personal conditions.

Translating it into daily practice

In practice, for each processing operation the manager should be able to answer three questions: which purpose, which Article 6 legal basis, for how long the data is kept. Mapping these answers feeds the record of processing activities and keeps the privacy notice consistent. Management software that structures registers, accounting and communications with this logic reduces the risk of processing data without a title. AmministraPro is built on this approach: the features described on the /funzioni page keep personal data, obligations and archives in order, and the plans shown on the /prezzi page let firms of every size work with clean legal bases from day one.