Practical GDPR guide
How to prepare the privacy notice for residents
Property managers handle personal data of residents every day: identity details, ownership shares, arrears, correspondence, and sometimes data related to intercom systems or CCTV on common areas. Article 13 of the GDPR requires informing the data subject, in this case the resident, about how this data is processed, before or at the moment of collection. A generic template downloaded from the internet is not enough: the notice must reflect the specific building, the purposes actually pursued and the parties handling the data, including the property manager as either controller or processor depending on the setup. This guide explains how to structure it, what it must contain to be genuinely compliant, and how to manage it over time.
What the privacy notice is and why the building needs one
The privacy notice is the document by which the data controller, typically the building association represented by the acting property manager, informs residents about what data it collects, for what purposes, and how. Article 13 GDPR sets the mandatory minimum content and the moment it must be provided: at the first meaningful contact, typically when a resident joins the building or when a new manager takes on the assignment.
A building is not a business and has no commercial profiling purposes, but it still acts as data controller for the data it collects to manage the property: resident and tenant registries, ownership share tables, financial statements, meeting minutes containing named references, maintenance reports or complaints. The absence of an up to date notice exposes the manager to challenges during an inspection and undermines residents trust in how their data is handled.
The processing purposes to disclose
The notice must list precisely the purposes for which data is processed, distinguishing those necessary for carrying out the mandate from any accessory purposes.
Typical purposes for a residential building include: administrative and accounting management (expense allocation, payment reminders, financial statements), convening and recording meetings, managing relationships with suppliers and contractors working on common areas, operating CCTV or access control systems where present, and complying with legal obligations such as tax or social security filings for employed staff such as a doorkeeper.
Data processed and categories of data subjects
The notice must specify which categories of data are collected: identity and contact details, cadastral and ownership share data, payment and arrears data, disability related data where relevant to works on common areas, and images captured by CCTV systems if present.
It should also identify data subjects beyond owners: tenants, cohabiting family members, and any occupants under a loan for use agreement. For each category it is useful to clarify whether the data is collected directly from the data subject or through third parties, for example a real estate agency or the outgoing manager during a handover.
Data subject rights, retention and disclosure to third parties
The notice must reference the rights set out in Articles 15 to 22 GDPR: access, rectification, erasure within applicable limits, restriction of processing, portability where applicable, and objection. It should indicate who a resident can contact to exercise them, typically the property manager or the data protection officer if one has been appointed.
It must also list the recipients to whom data may be disclosed: suppliers and contractors working on common areas, the accountant or payroll consultant for tax filings, the building council where established, and any third parties in case of litigation. Retention of administrative records should be described by reference to the timeframes set by the Civil Code for keeping accounting documentation and ordinary tax deadlines, without inventing retention periods not established by applicable rules.
Delivery, tracking and document management over time
The notice must be delivered to every resident at the first relevant processing event, for example when purchasing a unit or when a new manager takes over, and kept continuously available rather than distributed only once. It is good practice to keep a record of delivery and to maintain an updated list of residents and tenants who received it.
A management platform such as AmministraPro can help the property manager organize the building's document archive, track communications sent to residents, and keep the resident registry up to date, reducing the risk that the notice remains an isolated document disconnected from day to day management.
Frequently asked questions
Who is the data controller in a residential building?
As a rule the data controller is the building association itself, an entity without full legal personality but recognized as an autonomous controller for GDPR purposes, represented from time to time by the property manager. The manager therefore acts on behalf of the building association in fulfilling the information obligations toward residents, while controllership remains with the community of owners represented through the assembly.
Must the notice be delivered to tenants as well as owners?
Yes, if the building processes data of tenants or cohabiting family members, for example for intercom systems, common access management or meeting related communications concerning them, the notice must be provided to them as well. The general rule under Article 13 GDPR applies to anyone affected by the processing, regardless of their ownership title over the unit.
Is a separate notice needed for CCTV on common areas?
When a building installs CCTV systems on common areas, it is advisable to prepare a dedicated notice or a specific section indicating the security purposes, the area covered, the retention period for footage and the parties authorized to view it, in addition to the visible signage required in areas under video surveillance as required by applicable rules.
What happens if the notice is never delivered to residents?
Failure to deliver the notice exposes the building, through the property manager who handles compliance, to the risk of challenges in the event of an inspection or a complaint from a resident. It is therefore advisable to prepare it in writing, deliver it to every resident at the appropriate time, and keep evidence of delivery as part of the building's ordinary document management.
Can property management software help with privacy compliance?
Software such as AmministraPro does not replace legal review of the notice's content, but it can support the organizational side: centralized document archiving, an always up to date resident registry, and traceability of communications sent, all useful for demonstrating that the notice was actually made available to those entitled to receive it.
Try AmministraPro
Accounting, thousandths-based cost splitting, meetings, communications and artificial intelligence in a single Italian software, compliant with UNI 10801 and GDPR.