# Checklist: data protection in homeowners associations Source: https://conformitate.md/en/resources/checklist-homeowners-associations Updated: 2026-10-16 Free checklist A homeowners association is the controller of its residents’ data and needs a legal basis for each processing operation (art. 6), from calculating charges to CCTV. The checklist helps you check whether residents are informed, whether you process only the data you need, and whether the administrator and providers handle the data under the conditions of the law. 11 check questions, each with its article of the law Tick what you already have. You see at once what is missing against the basic requirements of Law 195/2024 and which package closes the gaps. 1. Do you have a legal basis for each processing of residents’ data: the register of owners, calculating charges, recovering debts, CCTV? [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") 2. Do residents receive the information the law requires: who processes their data, for what purposes and on what legal basis, to whom you disclose it, how long you keep it and what rights they have? [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 3. Do you make residents’ data public, such as outstanding debts, only to the extent the purpose requires and only where you have a legal basis for doing so? [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") 4. Have you set the purpose of the CCTV and limited the areas filmed and the retention period of the recordings to what that purpose requires? [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") 5. Are residents and visitors informed, when they are filmed, about the CCTV, who operates it and for what purpose? [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 6. Do you disclose recordings or excerpts from them only to persons and authorities to whom the law allows you to disclose the data? [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") 7. Do you process residents’ IDNP numbers or copies of their identity documents only where you have a legal basis for doing so? [art. 53](https://conformitate.md/en/law-195-2024/article-53 "Processing of a national identification number") 8. Do you have a written contract with the external administrator, the company that maintains the cameras and the other providers that process residents’ data on the association’s behalf? [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 9. Do the chair, the accountant and the other members with access to residents’ data process it only on the association’s instructions? [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 10. Do you keep a written record of processing activities? The exemption for organisations with fewer than 250 employees does not apply where the processing is not occasional or is likely to result in a risk to residents. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 11. Can you respond to a resident’s request for access to their data, including recordings in which they appear, without undue delay and within one month of receipt, extending that period only under the conditions of the law? [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 15](https://conformitate.md/en/law-195-2024/article-15 "Right of access by the data subject") Industry [Homeowners associations](https://conformitate.md/en/industries/homeowners-associations) --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing