How to appoint authorised persons in your management firm

Who is an authorised person and why the appointment matters

The condominium is the controller of its participants' data, and the administrator processes that data to carry out the mandate granted by the owners' meeting under Articles 1129 and 1130 of the Italian Civil Code. Inside the firm, however, the administrator does not handle information alone: front office staff, accountants, technicians and trainees do too. Article 29 of the GDPR and Article 2-quaterdecies of the Italian privacy code state that anyone acting under the authority of the controller or processor may process data only if authorised and instructed.

Appointing authorised persons is not red tape: it serves to limit access to those who genuinely need it and to make each person aware of their obligations. If the Italian supervisory authority carries out a check or an owner raises a complaint, the written act shows that the firm organised data access in a controlled way and does not leave information available to anyone passing by the desk.

What the authorisation act must contain

The act must be in writing and tailored to the role. It should identify the person, indicate who authorises them (the condominium as controller through the administrator, or the firm as processor), and define the scope: which categories of data they may process and for which purposes. An accountant will process financial and identifying data, a technician data on systems and maintenance, the front office communications.

Operating instructions should be attached to the text. There is no need for an encyclopaedic manual: clear rules are enough on how to keep credentials safe, how to handle paper and digital documents, the prohibition on disclosing data to unauthorised third parties, and the duty to report any anomaly or suspected breach immediately to the firm's privacy contact.

• Identifying details of the authorised person and their role.
• Scope of processing: permitted categories of data and purposes.
• Instructions on credentials, confidentiality and document retention.
• Duty to report anomalies promptly.
• Duration of the authorisation and reference to the mandate or employment contract.

Minimum permissions in the software

The authorisation on paper must be translated into concrete permissions in the software. The principle is data minimisation: each person sees and edits only what they need. A trainee does not need to export all records in bulk, and a collaborator handling a single building must not access the data of the other condominiums managed by the firm.

Good software lets you assign differentiated roles and access profiles and record who does what. This way the appointment document and the technical configuration coincide, and the firm can demonstrate consistency between what it authorised and what the system actually allows.

Keeping the list current and linking it to training

The list of authorised persons is a living document. It must be updated whenever someone is hired, changes role or leaves: when a collaborator leaves the firm, their credentials must be revoked the same day and the authorisation archived with the closing date. Access left active for a departed employee is one of the most frequent and easily avoidable vulnerabilities.

The appointment must also be accompanied by training: an authorised person who does not know the instructions is not really instructed. It helps to have receipt of the instructions signed and to schedule a short periodic refresher. With AmministraPro the firm manages roles, access profiles and operation tracking in a single environment; the features are described on the /funzioni page and the plans on the /prezzi page.

Frequently asked questions