DPO in a condominium: do you need to appoint one?

When the GDPR requires a DPO

Article 37 of the GDPR provides for the mandatory appointment of a DPO in three cases: when processing is carried out by a public authority or body, when the core activity consists of processing that requires regular and systematic monitoring of data subjects on a large scale, or when the core activity consists of large-scale processing of special categories of data.

An ordinary condominium is not a public body, does not carry out systematic monitoring as its core activity, and does not process special categories on a large scale. Managing the register, fees, communications and video surveillance of common areas does not reach the large-scale threshold required by the rule.

• Public body or authority: DPO mandatory
• Regular and systematic monitoring on a large scale as core activity: DPO mandatory
• Large-scale processing of special categories of data: DPO mandatory
• Ordinary condominium: DPO not mandatory

Controller, processor and the confusion to avoid

The DPO must not be confused with the controller or the processor, which are different figures and always present. In a condominium the data controller is the condominium as a collective body, while the manager acts as a processor appointed by the condominium, or as an independent controller for the data handled within their own practice.

These figures must be defined regardless of the DPO. The appointment of the processor can take place through the resolution entrusting the role to the manager, accompanied by a document describing purposes, categories of data and security measures. The DPO, when not mandatory, remains an optional choice and never replaces these roles.

When it may make sense to appoint one anyway

In some situations the voluntary appointment of a DPO can be useful, even if not required. Very large complexes with extensive video surveillance, concierge services with access control, charging stations profiling consumption, or particularly complex arrangements may approach higher risk thresholds.

In these cases it is advisable to seek assistance from a professional experienced in data protection to assess whether the processing reaches a scale that justifies or makes the figure prudent. A voluntary appointment, however, entails the same duties of independence and involvement provided for the mandatory DPO, so it should be weighed carefully and not improvised.

What to actually do, DPO or not

Beyond the DPO, every condominium must put the fundamentals in order: privacy notice to owners, record of processing where the conditions apply, definition of roles, proportionate security measures, and proper handling of video surveillance and communications. These are the duties that matter in practice.

A platform such as AmministraPro helps you keep together the register, documentation, communications and role-based access, making data handling orderly and demonstrable without adding burden. The features are described on the /funzioni page and the plans on the /prezzi page.

Frequently asked questions