Practical guide
Consent or privacy notice? What a condominium really needs
One of the most common misunderstandings in a condominium is confusing consent with the privacy notice, as if they were the same duty. They are not. The privacy notice is the act by which the controller explains to data subjects what data it processes, for what purposes and with what rights: it is almost always required. Consent, instead, is one of the possible legal bases for processing, and in a condominium it is needed only in limited cases, because most activities rest on contract, legal obligation or legitimate interest. Asking for consent where it is not needed creates confusion and causes problems when the data subject withdraws it.
Two different acts with different functions
The privacy notice fulfils a transparency duty set out in Articles 13 and 14 of the GDPR: every data subject has the right to know who processes their data, for what purposes, on what basis, for how long and to whom it may be disclosed. It is an informative act, not a request for permission.
Consent is another matter: it is an expression of will by which the data subject authorises a processing that, without that consent, would have no basis. It is needed only when no other suitable legal basis exists. In a condominium, where almost everything rests on contract, legal obligation or legitimate interest, consent remains the exception.
- Privacy notice: transparency act, almost always required
- Consent: legal basis, needed only for optional processing
- The notice is given to all data subjects, consent is asked only when needed
- Consent is always withdrawable, a contractual or legal basis is not
Why consent is almost never needed
Collecting fees, keeping the register, convening the meeting, managing the annual accounts, recovering debts: these all find their basis in contract, legal obligation or the condominium's legitimate interest. For none of them is the owner's consent required, and it would in fact be misleading.
The risk of misplaced consent is real. If a mandatory processing is based on consent and the data subject withdraws it, the controller finds itself formally without a basis for an activity that must instead continue. It is better to identify the correct basis from the outset and state it in the notice, reserving consent for optional uses only.
The cases where consent is the right choice
Consent becomes useful for processing not necessary for management. Typical examples are creating a shared directory with owners' contacts for mutual convenience, sending non-mandatory communications through channels chosen by the individual, or using data for purposes beyond the strictly managerial ones.
In these cases consent must be freely given, specific, informed and unambiguous, and must be withdrawable as easily as it was granted. Proof of the consent collected must also be kept, so it can be demonstrated in the event of a check, and the will of those who choose not to give it must be respected.
How to build an effective privacy notice
A well-drafted notice states the controller and its contacts, the purposes and legal bases, the categories of data, the recipients, the retention periods and the data subject's rights, in clear language. It must be provided at the time data is collected and kept easily accessible over time, not hidden among the documents.
Keeping together the notice, the record of processing and communications is easier with digital tools. A platform such as AmministraPro helps you distribute the notice to owners, store documentation and collect any consents in a traceable way. The features are described on the /funzioni page and the plans on the /prezzi page.
Frequently asked questions
In a condominium, is consent needed or is the privacy notice enough?
In most cases the privacy notice is enough. Management activities rest on contract, legal obligation or legitimate interest, so consent is not needed. The notice, instead, is almost always required because it fulfils the transparency duty: it explains what data is processed, for what purposes, on what basis and with what rights.
Are consent and the privacy notice the same thing?
No. The privacy notice is a transparency act by which the controller explains the processing, and it is almost always required. Consent, instead, is a legal basis, that is an authorisation from the data subject, and it is needed only when no other suitable basis exists. In a condominium, consent is the exception, not the rule.
What happens if I ask for consent where it is not needed?
A practical problem arises. If a mandatory processing is based on consent and the data subject withdraws it, the controller is left formally without a basis for an activity that must still continue. That is why it is better to identify the correct basis from the outset and reserve consent for optional processing only.
When is it correct to collect consent in a condominium?
For processing not necessary for management, such as a shared directory of contacts or optional communications through channels chosen by the individual. In these cases consent must be freely given, specific, informed and withdrawable as easily as it was granted, and proof of its collection must be kept.
Try AmministraPro
Accounting, thousandths-based cost splitting, meetings, communications and artificial intelligence in a single Italian software, compliant with UNI 10801 and GDPR.