Choose an industry

Medical & dental clinics Online stores Homeowners associations Accounting firms

Homeowners associations

Data protection for homeowners associations

A homeowners association is the controller of its residents’ data: names, flats, meter readings, debts and CCTV footage. Each processing operation needs a legal basis (art. 6), and residents must be informed (art. 13). Posting debts and CCTV are limited to the data the purpose requires. The chair and the building manager process data only on the association’s instructions.

Request a quote →Request a free consultation

An apartment block entrance with mailboxes and a camera that films only the entrance

Industry-specific risks

! 01

Debts posted at the entrance

A list with the names and flat numbers of residents in arrears, posted in the stairwell, discloses data to everyone who passes by. Even a flat number without a name can identify the owner. art. 4 art. 5 art. 6

! 02

CCTV in common areas

Monitoring stairwells and the courtyard requires a legal basis, informing the people filmed, and keeping the footage only for as long as necessary. art. 5 art. 6 art. 13

! 03

Data in group chats

Residents’ data shared in Viber or Telegram groups can reach unauthorised persons and escapes the association’s control. art. 5 art. 25 art. 32

Data you process

First and last nameAddress and flat numberIDNP for contractsPhone and emailMeter readingsDebts and paymentsCCTV footage

Your obligations under Law No. 195/2024

01A legal basis for each processing operation, including CCTV art. 6
02Informing residents about the processing of their data art. 13
03Only the data the purpose requires, kept only for as long as necessary art. 5
04Records of processing activities, where the processing is not occasional art. 30
05Written contracts with an external building manager and with providers that process data on the association’s behalf art. 28
06Instructions for the people who have access to residents’ data art. 29 art. 32

Documents we deliver

Every document is tailored to your activity, not copied from a template.

Records of processing activities art. 30

Privacy notice for residents art. 13

CCTV policy art. 5 art. 24

CCTV information sign art. 12 art. 13

Contracts with processors art. 28

How we work

From the first conversation to a complete compliance file

1
Free consultation
15 minutes online or by phone. We learn what your company does and what personal data it processes.
2
Assessment
We take stock of your data, processes and existing documents. You receive a gap report.
3
Documentation
We draft the records, policies and privacy notices tailored to your activity.
4
Implementation
We walk you through the documents and leave a written note for employees; on request, we hold a briefing session for them.

For a typical homeowners association

The Essential package + extra work, 12,400 MDL

This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data.

Calculate the exact price →

Packages

Fixed prices, no surprises

Choose a package by how your company processes data, not by headcount. Prices start from the lawyer's work, and a package costs less than its modules bought separately.

Essential

5,900MDL

Module value: 18,500 MDL · you save 12,600 MDL

Up to 3 processing activities · 2 privacy notices · 2 processor contracts

For a small company with simple processing: a shop, an office, an accounting firm, a homeowners' association.

✓Data inventory and gap report
✓Records of processing activities, with the legal basis and retention period of each
✓Data protection policy and a description of the security measures
✓Privacy notices for each group of people: clients, employees, patients
✓Contracts with processors, new or reviewed
✓Internal rules for data subject requests and for personal data breaches
✓The confidentiality commitment and the written note for employees

Online · delivered in 10 working days · 1 round of revisions · 14 calendar days of email questions

Choose Essential →

Extended

Custom

from45,000MDL

No limits · analysis at your premises

For clinic networks, banks and microfinance companies, groups of companies, public bodies, or companies that must appoint a data protection officer.

✓Everything in Extended, with no limits
✓Data protection impact assessments, as many as needed
✓Review of data flows and IT systems
✓Joint controller agreements, profiling, complex transfers

Priced after analysis, at module prices

Request a quote →

Not sure which package fits? Calculate the price → Request a free 15-minute consultation →

Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate.

Case studyIllustrative example

Case study: homeowners association

A homeowners association in Chișinău with 120 flats. The cameras in the stairwells and the courtyard ran with no rules of use, no notice to residents and no retention period for the recordings, and the list of debtors was posted at the entrance with names and flat numbers. The firm that maintained the cameras had access to the recordings, and exported clips were posted to the building's group chat on request.

ResultThe association now has a CCTV policy, warning signs, a privacy notice for residents, a retention period for the recordings, a contract with the maintenance firm and a format for the list of debts that does not identify anyone.

Free checklist

Homeowners associations

Check in 10 minutes whether your organisation meets the basic requirements of Law No. 195/2024.

Complete the checklist →

FAQ

What clients ask us

Can we post the list of debtors in the stairwell?

The Law has no specific rule on lists of debts. Posting one is processing that needs a legal basis and is limited to the data the purpose requires. Even a flat number without a name can identify the owner, so it is still personal data. art. 4 art. 5 art. 6

Do we need residents’ consent for CCTV?

Not necessarily. Consent is only one of the legal bases listed in art. 6(1); the association may rely, for example, on legitimate interests, unless another law provides otherwise or the residents’ rights override them. Whatever the legal basis, the people filmed must be informed, and footage is kept only for as long as necessary. art. 5 art. 6 art. 13

Who is responsible for the data: the chair or the association?

The association, as the controller that determines the purposes and means of the processing. The chair and the board members act under its authority and process data only on its instructions. An external building manager that processes data on the association’s behalf is a processor and needs a written contract. art. 4 art. 28 art. 29

Free consultation

Not sure where to start?

Request a free 15-minute consultation. We will tell you which obligations under Law No. 195/2024 apply to you and which steps are needed.

Request a quote →Request a free consultation

Data protection for homeowners associations

Industry-specific risks

Debts posted at the entrance

CCTV in common areas

Data in group chats

Data you process

Your obligations under Law No. 195/2024

Documents we deliver

From the first conversation to a complete compliance file

Free consultation

Assessment

Documentation

Implementation

Fixed prices, no surprises

Essential

Extended

Custom

Case studies and checklist

Case study: homeowners association

Homeowners associations

What clients ask us

Not sure where to start?

Find out what compliance costs for your company