Identify the legal basis for each processing activity

Fees and routine management → contract performance (Art. 6(1)(b) GDPR). CCTV → legitimate interest (Art. 6(1)(f)) plus a notice sign. Marketing communications from the firm → consent (Art. 6(1)(a)). If you cannot state the legal basis for a processing activity in one sentence, it is not properly justified.

Keep your privacy notice ready (Arts. 13-14 GDPR)

Every owner must know, at the point their data is collected, who processes it, for what purpose, for how long, and how to exercise their rights. Check that the management contract and onboarding forms include it, not just the firm's website.

Keep the Record of Processing Activities (RoPA) up to date

Art. 30 GDPR requires documenting each processing activity: purpose, categories of data and data subjects, recipients, retention periods and security measures. A firm managing several communities is almost always required to keep this record, regardless of any single community's size.

Never post arrears information on notice boards or general-access minutes

Debt is personal data of an economic nature. The AEPD repeatedly fines this practice. It can appear in internal board documentation, but never be displayed in communal areas.

CCTV footage: 30-day maximum

Art. 22 LOPDGDD sets a maximum 30-day retention period for footage from communal-area cameras, unless it must be kept as evidence of an offence or criminal act. Check the actual recorder configuration, not just what the installer's contract states.

Minutes and accounts: 5-10 years

Minutes and accounts must be kept for at least 5 years under Spanish tax and accounting obligations (General Tax Law). GDPR also requires that personal data not be kept longer than necessary for the original purpose: define your firm's criterion in writing (typically 5-10 years) and apply it consistently.

Departing owners (property sold)

Do not delete their data immediately: outstanding debts or open claims may justify keeping it for the applicable statute-of-limitations period. Document the blocking/erasure criterion your firm applies so it is not left to each staff member's own judgement.

Inventory every supplier with access to data

Property management software, cloud accounting, resident communication platforms, payroll services for caretakers, SMS/email providers — any company that accesses personal data from the communities you manage is, under GDPR, a data processor (Art. 28 GDPR).

Confirm a signed DPA exists with each of them

Art. 28(3) GDPR requires the contract with each processor (or sub-processor) to specify: subject matter and duration of processing, nature and purpose, type of data and categories of data subjects, and the controller's obligations and rights. If a supplier cannot provide its DPA, treat that as a red flag.

Confirm where the data is hosted

If any supplier transfers data outside the EU/EEA, an adequate safeguard must be in place (standard contractual clauses, an adequacy decision) under Chapter V GDPR. Ask explicitly about server location — do not assume it is within the EU.

Have a written breach notification procedure

Don't improvise on the day of the incident. Define: who detects and escalates a breach internally, who decides whether owners are at risk, who drafts and submits the notification to the AEPD (Art. 33 GDPR) through its electronic office, and when affected owners must also be notified directly (Art. 34 GDPR, when the risk is high).

Keep a breach register, whether notified or not

Art. 33(5) GDPR requires documenting every security breach, its effects and the remedial measures taken, even if you concluded it did not need to be notified to the AEPD. That register is the first thing an inspector will ask for during an audit.

Respond to access, rectification and erasure requests within one month

Arts. 12-22 GDPR set a one-month deadline (extendable by two further months for complex requests, with the reason notified). An owner's arrears status is never a valid reason to deny them access to their own data. Keep a response template and a clear intake channel for these requests.

Treat health data as special category data (Art. 9 GDPR)

When an owner requests an accessibility adaptation (a ramp, an adapted lift, a reserved parking space) due to reduced mobility or a disability, that request can carry information about their health. Health data falls within Art. 9 GDPR special categories, whose processing is prohibited by default except for specific exemptions — including the data subject's explicit consent (Art. 9(2)(a)) or where processing is necessary to comply with accessibility-related obligations. In practice: collect only the minimum data needed (a justification of the need, not a full diagnosis), restrict who within the firm can see it, and do not merge it with the owner's general arrears or complaints file.

Train the team and review this checklist yearly

Staff turnover and regulatory changes make a two-year-old checklist stale. Schedule an annual review of these 15 points, especially after onboarding a new SaaS supplier or changing your CCTV system.