Practical guide
How to respond to a data erasure request in a condominium
The right to erasure, often called the right to be forgotten, allows the data subject to obtain the deletion of their personal data in certain cases. In a condominium it happens that a former owner, after selling, asks the management firm to erase their data. The request should neither be ignored nor automatically granted: it must be assessed, because erasure yields to the retention obligations imposed by law, for example on accounting and minutes. This guide explains how to recognise a valid request, when it can be refused, within what time to respond and how to document the decision.
Checklist for handling an erasure request
- Record the request with the date of receipt and the requester's identity.
- Verify the data subject's identity before proceeding.
- Identify which data is involved and for what purposes it is processed.
- Assess whether retention obligations prevail over erasure.
- Erase data no longer needed and keep the data required by law.
- Respond in writing within the deadline, giving reasons for any partial refusal.
- Record the decision and the actions taken in the compliance file.
When the right to erasure applies
Article 17 of the GDPR grants the data subject the right to obtain the erasure of data concerning them in certain cases: when the data is no longer necessary for the purposes for which it was collected, when they withdraw the consent on which processing was based and there is no other legal basis, when they legitimately object to the processing, or when the data was processed unlawfully.
The right, however, is not absolute. Article 17 itself provides for relevant exceptions, including compliance with a legal retention obligation and the establishment, exercise or defence of a legal claim. In a condominium these exceptions weigh heavily, because much of the data is processed to meet legal duties tied to management, accounting and the life of the owners' meeting.
Why erasure in a condominium is often partial
A former owner can legitimately ask that their data no longer needed be removed, for example from mailing lists or communications that no longer concern them. But they cannot demand the complete erasure of every trace of their past participation, because some documents must be kept by legal obligation or for evidential needs.
Meeting minutes, the accounting register and the supporting documents for expenses often contain the name and data of the participants of the time. These documents cannot be mutilated on request, because they answer to retention obligations and to the need to reconstruct the condominium's management. The correct response is therefore typically a well-reasoned partial erasure.
- Erasable: data no longer needed, subscriptions to communications not due.
- To keep: minutes, accounting register, expense records for the legal terms.
- To assess case by case: contacts and addresses no longer useful for management.
- Always required: give written reasons for what is kept and why.
Timing and manner of the response
The controller must respond without undue delay and in any case within one month of receiving the request. The deadline can be extended by a further two months for complex or numerous requests, but the extension must be communicated to the data subject within the first month, explaining the reasons. The response is free of charge, except for manifestly unfounded or excessive requests.
Before acting you must verify the requester's identity, to avoid erasing or disclosing data on the application of an unauthorised person. The response must be in writing and must state what has been erased and what has been kept, with the reasoning. An unexplained total refusal exposes the firm to a complaint; a clear, reasoned response, even when it partly denies, protects both the data subject and the firm.
Documenting the decision and using the right tools
Every request and every response should be documented: date of receipt, identity verification, data involved, decision taken and reasoning. This traceability flows into the firm's accountability file and shows that data subjects' requests are handled seriously and consistently, not left to improvisation.
Having software that lets you quickly identify all data linked to a person, distinguish erasable data from data subject to retention and keep a record greatly simplifies this work. AmministraPro's features useful for managing data and data subjects' requests are described on the /funzioni page and the plans on the /prezzi page.
Frequently asked questions
Can a former owner ask to erase all their data?
They can ask, but the right to erasure is not absolute. Data no longer needed can be removed, while data subject to retention obligations, such as minutes, the accounting register and expense records, must be kept for the legal terms. The response is therefore often a reasoned partial erasure.
Within what time must I respond to the request?
Without undue delay and in any case within one month of receipt. The deadline can be extended by two months for complex requests, but the extension must be communicated to the data subject within the first month, explaining the reasons. The response is normally free of charge.
Can I refuse an erasure request?
Yes, when one of the exceptions provided by Article 17 of the GDPR applies, such as a legal retention obligation or the defence of a claim in court. The refusal, even partial, must always be justified in writing and communicated to the data subject, who may still turn to the supervisory authority.
Must I verify the identity of whoever requests the erasure?
Yes. Before erasing or disclosing any data you must ensure the request really comes from the data subject or an authorised person. Acting on the application of an unidentified person risks harming the rights of third parties and is itself unlawful processing.
Try AmministraPro
Accounting, thousandths-based cost splitting, meetings, communications and artificial intelligence in a single Italian software, compliant with UNI 10801 and GDPR.