Privacy regulation
Handling GDPR data access requests
Every resident, as a data subject under the GDPR, can ask the property manager which personal data concerning them is being processed, for what purpose, and who can access it. This right, set out in Article 15 of Regulation EU 2016/679, fully applies to condominium management because the manager processes registry data, ownership shares, payment records and, in some cases, information related to disputes or arrears. Handling these requests correctly means respecting fixed deadlines, providing a complete and traceable response, and separating the requester's own data from that of other residents. A clear procedure avoids disputes and reduces the risk of complaints to the data protection authority.
What a resident can ask for
Article 15 GDPR gives the data subject the right to obtain confirmation of whether personal data concerning them is being processed and, if so, to access that data together with a set of information: the purposes of processing, the categories of data processed, the recipients or categories of recipients to whom the data has been or will be disclosed, the retention period or the criteria used to determine it, and the existence of the right to rectification, erasure or restriction.
- A copy of their own registry and contact details kept in the condominium ownership register
- An extract of their own accounting position: shares paid, shares due, any reminders sent
- Information on communications concerning them sent to third parties, for example in debt recovery cases
- The purposes for which the manager processes this data and for how long it is retained
The response times required by the regulation
The GDPR sets a one month deadline from receipt of the request to provide a response, calculated from the date the request was actually received in an intelligible form, not from when the manager reads it. This deadline can be extended by a further two months when the request is particularly complex or numerous, but the manager must inform the data subject of the extension and the reasons for it within the first month.
If the manager does not intend to act on the request, a response must still be given within the same deadline, stating the reasons for refusal and informing the data subject of the possibility of lodging a complaint with a supervisory authority and of seeking a judicial remedy. Silence is never an acceptable response and exposes the manager to direct liability as controller or processor, depending on the mandate received.
How to prepare a correct and complete response
Before responding, the manager must verify the identity of the requester to avoid disclosing personal data to unauthorized parties: a request coming from an email address not clearly linked to the resident, for instance, should be answered by first asking for appropriate identity confirmation.
The response must be limited to data concerning the requester alone: if accounting records also show data belonging to other residents, that information must be redacted or excluded, because the right of access does not extend to information about third parties. For this reason, account statements, ownership share tables and meeting minutes must be filtered line by line before delivery.
The first copy must be provided free of charge; for further copies of the same documentation, the manager may charge a reasonable fee based on administrative costs. It is advisable to put the response in writing, attach the relevant documents, and keep a copy of both the request and the response provided.
The request register as a protective tool
Keeping a register of access requests received, with the date received, the date responded to, and a summary of the content provided, helps the manager demonstrate compliance with the deadlines in case of a check or complaint. This register is not an explicit GDPR obligation but follows from the accountability principle of Article 5, which requires the controller to be able to demonstrate compliance of their procedures at all times.
In a context where the manager handles multiple condominiums and multiple requests over time, having an organized digital trail, with attached documents and deadlines linked, reduces the risk of missing a deadline or answering incompletely. Property management software built for this sector, such as AmministraPro, can help organize resident registries, accounting documentation and communications in a single searchable archive, making it easier to reconstruct the data to provide when an access request arrives.
Frequently asked questions
Can a resident also request data about other residents?
No. The right of access under Article 15 GDPR concerns exclusively the personal data relating to the requester themselves. If condominium records also contain data belonging to other residents, such as names, shares or arrears, that information must be redacted or removed before delivery, because one resident's request does not legitimize access to information about third parties.
What happens if the manager does not respond within one month?
Failure to respond within the required deadline constitutes a GDPR violation and exposes the manager, acting as controller or processor, to the risk of a complaint from the data subject to the data protection authority. The deadline can only be extended by two months in cases of particular complexity, and the extension must be communicated with reasons within the first month, not after.
What specific data typically falls within a resident's request in a condominium context?
Typically this includes registry and contact details kept in the condominium ownership register, an extract of the resident's personal accounting position with shares paid and due, communications concerning them sent to third parties such as in debt recovery procedures, and information on the purposes and retention period of this data by the manager.
Can the manager charge for providing this data?
The first copy of the requested data must be provided free of charge. Only for requests for further copies of the same documentation can the manager charge a reasonable fee, proportionate to the administrative costs incurred in searching for and preparing the documents, without this becoming an obstacle to exercising the right.
How should this process be organized in practice across multiple condominiums?
It helps to keep a register of requests received with the date of arrival, the date of response, and a summary of what was provided, so compliance with the deadlines can be demonstrated if checked. Management software such as AmministraPro, which centralizes registry data, accounting and communications for each condominium, helps quickly reconstruct a single resident's data when an access request arrives.
Try AmministraPro
Accounting, thousandths-based cost splitting, meetings, communications and artificial intelligence in a single Italian software, compliant with UNI 10801 and GDPR.