Checklist: data protection in homeowners associations

☐ Do you have a legal basis for each processing of residents’ data: the register of owners, calculating charges, recovering debts, CCTV? art. 6

☐ Do residents receive the information the law requires: who processes their data, for what purposes and on what legal basis, to whom you disclose it, how long you keep it and what rights they have? art. 12art. 13

☐ Do you make residents’ data public, such as outstanding debts, only to the extent the purpose requires and only where you have a legal basis for doing so? art. 5art. 6

☐ Have you set the purpose of the CCTV and limited the areas filmed and the retention period of the recordings to what that purpose requires? art. 5

☐ Are residents and visitors informed, when they are filmed, about the CCTV, who operates it and for what purpose? art. 12art. 13

☐ Do you disclose recordings or excerpts from them only to persons and authorities to whom the law allows you to disclose the data? art. 5art. 6

☐ Do you process residents’ IDNP numbers or copies of their identity documents only where you have a legal basis for doing so? art. 53

☐ Do you have a written contract with the external administrator, the company that maintains the cameras and the other providers that process residents’ data on the association’s behalf? art. 28

☐ Do the chair, the accountant and the other members with access to residents’ data process it only on the association’s instructions? art. 29art. 32

☐ Do you keep a written record of processing activities? The exemption for organisations with fewer than 250 employees does not apply where the processing is not occasional or is likely to result in a risk to residents. art. 30

☐ Can you respond to a resident’s request for access to their data, including recordings in which they appear, without undue delay and within one month of receipt, extending that period only under the conditions of the law? art. 12art. 15