# Case study: homeowners association Source: https://conformitate.md/en/case-studies/homeowners-association Updated: 2026-10-16 Case study Illustrative example A homeowners association processes data about its residents every day. The cameras and the debtor list need a legal basis (art. 6), the data must be limited to what is necessary for the purpose and kept no longer than necessary (art. 5), and residents must be informed about the processing, including CCTV (art. 13). In this illustrative example, these requirements were not met. ## The situation A homeowners association in Chișinău with 120 flats. The cameras in the stairwells and the courtyard ran with no rules of use, no notice to residents and no retention period for the recordings, and the list of debtors was posted at the entrance with names and flat numbers. The firm that maintained the cameras had access to the recordings, and exported clips were posted to the building's group chat on request. ## What was missing 1. The cameras ran with no defined purpose and no established legal basis. Without a purpose, the association could not even judge which areas needed filming. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") 2. Residents and visitors were not informed: there were no warning signs and no notice saying who the controller is, why filming takes place, how long the footage is kept and what rights the people filmed have. [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 3. The recordings had no retention period, although data are kept only for as long as the purpose for which they were collected requires. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") 4. The list of debtors, with names and flat numbers, was visible to anyone entering the building. To recover debts, the association has no need to make them public. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") 5. The maintenance firm had access to the recordings with no contract governing the processing on the association's behalf. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 6. Exported clips circulated in the building's group chat, with no rule on who has access to the footage or whom it may be passed to. [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") ## The risks ### A fine for basis, principles and notice CCTV with no legal basis and no storage limit breaches art. 5 and 6, and the lack of notice breaches art. 13. For both, the law provides for fines of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover, whichever is higher. Of the fine imposed, 10% applies in the first year after the law enters into force. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions") ### Complaints from residents A resident whose name is on the posted list or whose footage ended up in the group chat may lodge a complaint with the Centre. For a continuing infringement, such as a list that stays up, the one-year period runs from the date of the last act. The resident may also claim compensation for non-material damage. [art. 72](https://conformitate.md/en/law-195-2024/article-72 "Right to lodge a complaint with the Centre") [art. 76](https://conformitate.md/en/law-195-2024/article-76 "Right to compensation and liability") ### Orders from the Centre During an inspection, the Centre may require any information, obtain access to the premises and the recording equipment, and order the processing to be brought into compliance by a set deadline or temporarily limit the CCTV. Failing to comply with such a measure is a distinct infringement, punishable by a fine of up to 2,000,000 lei. [art. 60](https://conformitate.md/en/law-195-2024/article-60 "Powers of the Centre") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") ## What is in place now 1. A CCTV policy, so that every camera serves a specified purpose and rests on an established legal basis. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") 2. Warning signs at the entrances and a privacy notice for residents, so that the people filmed learn who processes the footage and what rights they have. [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 3. A retention period for the recordings, after which they are erased. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") 4. A format for the list of debts that does not identify anyone, so that reporting on the building's finances discloses no one's data. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 25](https://conformitate.md/en/law-195-2024/article-25 "Data protection by design and by default") 5. A written contract with the maintenance firm as a processor. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 6. Instructions for the chair and the board members on access to footage, so that it no longer circulates in group chats. [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") ## Result The association now has a CCTV policy, warning signs, a privacy notice for residents, a retention period for the recordings, a contract with the maintenance firm and a format for the list of debts that does not identify anyone. For a typical homeowners association The Essential package + extra work, 12,400 MDL This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data. [Calculate the exact price →](https://conformitate.md/en/tools/price-calculator?profil=asociatii-de-proprietari) FAQ ## Questions about this case ### How long may the association keep CCTV recordings? The law sets no fixed number of days. Footage is kept only for as long as the purpose for which it is collected requires, and the period, or the criteria used to set it, is communicated to the people filmed. A longer period has to be justified by the purpose of the CCTV. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") ### Can the association hand recordings to a resident or the police? A resident has the right of access to footage showing him or her, but the copy provided must not adversely affect the rights and freedoms of others, such as neighbours in the same frames. Disclosure to the police needs a legal basis, usually an obligation laid down by law. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 15](https://conformitate.md/en/law-195-2024/article-15 "Right of access by the data subject") ### Does the firm that maintains the cameras need a separate contract? Yes, if it has access to the recordings or stores them. It processes the data on the association's behalf as a processor, and that processing is governed by a contract or other legal act, in writing, including in electronic form. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") ### Is a data protection impact assessment needed for the building's cameras? An assessment is mandatory where the processing is likely to result in a high risk, in particular for systematic monitoring of a publicly accessible area on a large scale. Cameras in the stairwells of a single building do not usually fall into that category, but the association should also check the list of processing operations approved by the Centre. [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") Related pages [Homeowners associations](https://conformitate.md/en/industries/homeowners-associations) [Data access request](https://conformitate.md/en/situations/data-access-request) [Inspection by the Centre](https://conformitate.md/en/situations/inspection-by-the-centre) [Principles and legal bases](https://conformitate.md/en/law-195-2024/principles-and-legal-bases) [Data subject rights](https://conformitate.md/en/law-195-2024/data-subject-rights) [The Centre, complaints and inspections](https://conformitate.md/en/law-195-2024/centre-complaints-and-inspections) --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing