The legal basis for processing personal data in a condominium

Why the legal basis comes first

The legal basis is not a formality but the condition of lawfulness for processing. Without a valid basis, collecting or disclosing data is unlawful even if the privacy notice is impeccable and the data is stored securely. That is why it must be identified before designing any activity.

In a condominium the data controller is the condominium itself, while the manager acts as a processor appointed by resolution, or as controller for the data handled within their own practice. In both roles they must document, for each purpose, which basis under Article 6 applies.

• Collecting fees and managing accounts: performance of the contract or mandate
• Convening the owners' meeting and keeping the ownership register: legal obligation (Articles 66 and 1130 of the Italian Civil Code)
• Recovering debt from a defaulting owner: legitimate interest of the condominium
• Video surveillance of common areas approved by the meeting: legitimate interest

Contract and mandate: the most frequent basis

Most processing activities serve to perform the relationship between condominium and owner, or between condominium and manager. Issuing instalments, recording payments, managing the annual accounts, keeping the ownership register required by Article 1130 no. 6 of the Italian Civil Code: these are necessary to perform the contract and are therefore lawful without consent.

The practical advantage is stability: an owner cannot revoke a contractual basis while the relationship exists, unlike consent which can always be withdrawn. Asking for consent for mandatory operations creates the illusion of a choice that does not really exist, and should be avoided.

Legal obligation and legitimate interest

Many duties derive directly from the law. Keeping the ownership register, convening the meeting under Article 66 of the implementing provisions, and retaining accounting documents and proxies rest on a legal obligation. Here too consent is not required.

Legitimate interest instead covers purposes that are useful for management but not imposed by a specific rule, such as debt recovery or the security of common areas. To use it you must carry out and document a balancing test between the condominium's interest and the rights of the data subject, verifying that the processing is necessary and proportionate and that the person's expectations of privacy do not prevail.

• Check that a real and current interest exists, not a hypothetical one
• Verify there are no less intrusive ways to achieve the purpose
• Put the balancing reasoning in writing and keep it
• Remember that the data subject can object to processing based on legitimate interest

When consent is actually needed

Consent remains the correct basis only for optional processing that is not necessary for management. A typical example is adding a mobile number or email address to a directory shared among owners for convenience, or sending non-mandatory communications through channels chosen by the individual. In these cases consent must be freely given, specific, informed and withdrawable at any time, as easily as it was granted.

Using consent where another basis would suffice is a recurring mistake: if the owner withdraws it, the mandatory processing should stop, which is impossible for ordinary management. It is better to reserve consent for genuinely optional uses.

How to map legal bases in the register

The most effective way to avoid mistakes is to start from the list of purposes and assign each one its basis, recording it in the record of processing activities and in the privacy notice. Management supported by digital tools helps because it keeps an orderly trace of who accesses which data and for what purpose.

A platform such as AmministraPro lets you organise the register, accounting and communications with access logs and differentiated roles, so the match between each piece of data and its purpose is demonstrable. The features are described on the /funzioni page and the plans on the /prezzi page.

Frequently asked questions