Data protection in your community of owners in Spain: cameras, the debtor list, the WhatsApp group and your rights

Three questions reach us from owners abroad more often than any other about the data a community of owners holds: who is allowed to watch the recordings of the camera at the pool gate, whether the community may hang the names of the owners behind with their fees in the lobby, and who gave the president's WhatsApp group their mobile number. The answers live in three texts read together: the EU's General Data Protection Regulation, Spain's Ley Orgánica 3/2018 (the LOPDGDD) and the Horizontal Property Act, which is the law that makes a community process your data in the first place. This piece reads them with the guides of the Agencia Española de Protección de Datos, the Spanish data authority, and six of its resolutions against communities of owners, two of them in the Canaries. Quotations are in Spanish with the reading in English.

Who answers for your data: the community, and the administrator on its behalf

The Regulation defines the controller as whoever determine los fines y medios del tratamiento — determines the purposes and means of the processing (article 4.7) — and the processor as whoever trate datos personales por cuenta del responsable del tratamiento — processes personal data on the controller's behalf (article 4.8). In a community of owners the roles are fixed. The AEPD's sectoral guide on data protection and property administration says that La condición de responsable del tratamiento recae sobre la comunidad de propietarios — the status of controller falls on the community of owners — and that the administrator is its encargado del tratamiento — its processor. The Agency's FAQ for communities adds the consequence: el contrato entre la comunidad y el administrador deberá contener las respectivas cláusulas de protección de datos — the contract between the community and the administrator must contain the corresponding data-protection clauses. Article 28.3 of the Regulation describes them: the processing se regirá por un contrato u otro acto jurídico — is governed by a contract or other legal act — under which the processor tratará los datos personales únicamente siguiendo instrucciones documentadas del responsable — processes the personal data only on the controller's documented instructions — keeps them confidential, applies the security measures of article 32, helps the community answer owners' requests and deletes or returns everything when the engagement ends. An administrator's quote that comes without that annex is missing a page; our piece on administrator fees lists what else it should contain.

The community needs no consent from you for its ordinary work. The AEPD's own words: la legitimación para el tratamiento de los mismos no deriva de la existencia de que hayan prestado el consentimiento previo, sino con base en el cumplimiento de una obligación legal (el contenido de la Ley de Propiedad Horizontal) — the lawful basis does not derive from the owners having given prior consent, but from compliance with a legal obligation, the content of the Horizontal Property Act. In the Regulation's terms that is article 6.1.c, processing necessary for el cumplimiento de una obligación legal aplicable al responsable del tratamiento — compliance with a legal obligation to which the controller is subject. Your name, your quota, your account for the fees, your address for the notices: the Act obliges the community to hold them. Consent returns the moment the data is used for something the Act does not require, and the two everyday examples are a chat group and a marketing list.

Two housekeeping duties follow. Article 30 of the Regulation exempts organisations with menos de 250 personas — fewer than 250 employees — from keeping a record of processing activities unless the processing no sea ocasional — is not occasional — and a community's is not: the AEPD asks both the community and the administrator to keep a registro de actividades de tratamiento — record of processing activities — for the treatments it calls «propietarios» and «videovigilancia», an internal document that is filed nowhere but shown to the Agency on request. A data protection officer is not required; the FAQ says no es obligatorio su nombramiento — the appointment is not compulsory — because communities appear neither in article 37 of the Regulation nor in the list of article 34 of the LOPDGDD.

Cameras: the vote that makes them lawful

Article 22.1 of the LOPDGDD lets any natural or legal person process images through cameras con la finalidad de preservar la seguridad de las personas y bienes, así como de sus instalaciones — for the purpose of preserving the security of persons and property, and of their installations. For a community the AEPD's guide places the basis in el interés público, recogido en el artículo 6.1 e) del RGPD — the public interest of article 6.1.e of the Regulation — and puts one thing first: será necesario, con carácter previo a dicha instalación, el acuerdo de la Junta de Propietarios — before the installation, the resolution of the owners' meeting is required. The guide wants it in the minutes and recommends that en el acuerdo se reflejen algunas de las características del sistema de videovigilancia, así como el número de cámaras o el espacio captado por las mismas — the resolution reflect some characteristics of the system, such as the number of cameras and the space they capture.

The Act does not mention cameras, so the majority is a matter of interpretation. The AEPD's own resolutions read them under article 17.3: El establecimiento o supresión de los servicios de portería, conserjería, vigilancia u otros servicios comunes de interés general, supongan o no modificación del título constitutivo o de los estatutos, requerirán el voto favorable de las tres quintas partes del total de los propietarios que, a su vez, representen las tres quintas partes de las cuotas de participación — establishing or removing porter, concierge, surveillance or other common services of general interest, whether or not they modify the constitutive title or the statutes, requires the favourable vote of three fifths of all the owners representing three fifths of the quotas. That is the vote we put on the agenda in the communities we administer, with the number of cameras and the areas listed in the resolution, because a three-fifths vote is the one nobody can challenge later.

A resident's own camera on the landing is a different matter, and a recent Canary case shows how the Agency treats it. In a building in San Cristóbal de La Laguna an owner had fitted a digital peephole on the front door and, by the neighbours' account, a camera in a window over the communal courtyard, and had posted images of the neighbours on social media. The Policía Nacional inspected the building in January 2026 at the Agency's request, found no sign and confirmed that the community had authorised nothing. The AEPD's resolution of 23 January 2026 says that Los particulares no pueden instalar cámaras que afecten a zona de rellano (zona común) del inmueble, sin que exista una autorización expresa del conjunto de propietarios — private individuals may not install cameras affecting the landing, a common area, without the express authorisation of all the owners — and ordered every device removed within 15 working days, with photographs before and after.

What the cameras may film, who may watch, and how long the images live

Article 22.2 draws the outer line: Solo podrán captarse imágenes de la vía pública en la medida en que resulte imprescindible para la finalidad mencionada en el apartado anterior — images of the public road may be captured only to the extent indispensable for the purpose of the previous paragraph. The AEPD's guide on the use of video cameras, in its February 2025 edition, turns that into three rules for a community: the cameras film the common areas only, the street a excepción de una franja mínima de los accesos al inmueble — except for a minimal strip at the building's accesses — and never terrenos y viviendas colindantes o de cualquier otro espacio ajeno — neighbouring land and dwellings or any other third-party space; a camera that pans or zooms needs privacy masks. The same edition settles the question we hear most on the island: La instalación de videocámaras en la piscina comunitaria, también se regirá por las reglas anteriormente descritas — the installation of cameras at the community pool is also governed by the rules just described. The pool is a common area like the gate, so a camera may watch it under the same vote and the same limits, and never the terraces of the block next door.

Who watches is the second rule. El acceso a las imágenes estará restringido a las personas designadas por la comunidad de propietarios — access to the images is restricted to the persons designated by the community — the recorder sits in a locked or supervised room, each authorised person has a user code and a password, and En ningún caso estarán accesibles a los vecinos mediante canal de televisión comunitaria — in no case may the images be available to the neighbours through the community television channel. The Agency's 2026 resolution names the usual pair: es el Presidente o el Administrador, los encargados de acceder a las imágenes — the president or the administrator are the ones charged with accessing the images — and with handing them to the authorities when something is recorded. Hiring a security company or leaving the installer its remote access changes nothing for the community: La contratación de un servicio de videovigilancia externo o la instalación de las cámaras por un tercero no exime a la comunidad del cumplimiento de la legislación de protección de datos — contracting an external surveillance service or having the cameras installed by a third party does not exempt the community from complying with data protection law; and a system connected to an alarm centre may only be operated by a private security company licensed under the Ley 5/2014.

The third rule is time. Article 22.3: Los datos serán suprimidos en el plazo máximo de un mes desde su captación, salvo cuando hubieran de ser conservados para acreditar la comisión de actos que atenten contra la integridad de personas, bienes o instalaciones — the data shall be deleted within a maximum of one month from capture, except where they must be kept to prove acts against the integrity of persons, property or installations — and in that case the images go to the competent authority en un plazo máximo de setenta y dos horas desde que se tuviera conocimiento de la existencia de la grabación — within a maximum of seventy-two hours of learning that the recording exists. The recorder in a community we administer overwrites itself after 30 days; a clip kept for a complaint is copied out, attached to the denuncia and kept for the police or the court that asks for it, and the AEPD is explicit that such images No podrán utilizarse para otro fin — may not be used for any other purpose. Finding out who leaves the rubbish by the lift is not a purpose article 22.1 knows.

The sign at the gate and your rights over the images

Article 22.4 says how a community informs the people it films: the duty se entenderá cumplido mediante la colocación de un dispositivo informativo en lugar suficientemente visible identificando, al menos, la existencia del tratamiento, la identidad del responsable y la posibilidad de ejercitar los derechos previstos en los artículos 15 a 22 — is deemed fulfilled by placing an information sign in a sufficiently visible place identifying, at least, the existence of the processing, the identity of the controller and the possibility of exercising the rights of articles 15 to 22 of the Regulation. The AEPD publishes a model sign; the rest of the information article 13 of the Regulation requires may be available, in the guide's words, en conserjería, recepción, oficinas, tablones de anuncios o ser accesible a través de internet — at the concierge's, the reception, the offices, the noticeboards or online. A resort whose reception holds that sheet in the languages of its owners has done what the law asks.

Your rights over the images are narrower than over your other data, and the guide says why. Access exists, but it requiere aportar como documentación complementaria una imagen actualizada que permita al responsable verificar y contrastar la presencia del afectado en sus registros — requires a recent image of yourself so the controller can find you in its records — and since a frame almost always shows other people, the answer may be a certified written description of what was recorded rather than the footage. Erasure is the one-month rule itself; rectification cannot apply to a recording of a fact, and portability does not apply because the basis is neither consent nor a contract. The right that matters in practice is the opposite one, restriction of processing, under which you ask the community to keep the images when El responsable ya no necesite los datos para los fines del tratamiento pero el interesado si los necesite para la formulación, ejercicio o defensa de reclamaciones — the controller no longer needs the data for its purposes but you need them to make, exercise or defend a claim. If your car was scratched in the garage on a Tuesday, the request to preserve that day's recording goes to the administrator the same week, before the recorder overwrites it.

The debtor list: the two places the Act puts it

The Act itself publishes who is behind with the fees, in two places and no more. The first is the notice of the meeting. Article 16.2: La convocatoria contendrá una relación de los propietarios que no estén al corriente en el pago de las deudas vencidas a la comunidad y advertirá de la privación del derecho de voto si se dan los supuestos previstos en el artículo 15.2 — the notice shall contain a list of the owners who are not up to date with the debts due to the community and shall warn of the loss of the right to vote in the cases of article 15.2. The second is the minutes. Article 15.2 lets an owner in arrears attend, si bien no tendrán derecho de voto — although without the right to vote — and adds that El acta de la Junta reflejará los propietarios privados del derecho de voto — the minutes shall record the owners deprived of the vote. Every owner receives the notice and the minutes, so every owner learns who owes what; the AEPD's guide reads the Act exactly that far: the legal authorisation únicamente justifica su inclusión en la Convocatoria de la Junta de Propietarios y en el acta que de la misma se concluya — only justifies their inclusion in the notice of the meeting and in the minutes drawn from it.

Everything else is off limits. The guide's opening line on the subject: la publicación en el tablón de avisos de la finca de la identidad de los propietarios deudores y/o de las cuotas vencidas e impagadas por estos a la comunidad no está amparada por la normativa de protección de datos — publishing on the building's noticeboard the identity of the owners in arrears and/or the fees they have left unpaid is not covered by data protection law. Nor is the monthly statement that lists the debtors for everyone, and the guide closes the door administrators like to leave ajar, the list by flat number without names: Incluso en el supuesto en el que no se haga mención expresa a la identificación personal del vecino o vecinos deudores, significando únicamente el dato relativo a la vivienda, dicha comunicación tampoco resulta conforme con la normativa de protección de datos — even where the debtor is not named and only the dwelling is indicated, that communication is not compliant either, because a flat number identifies its owner to everyone in the building. The one lawful disclosure outside the meeting is the debt certificate of article 9.1.e, issued to the seller for the buyer and the notary; our piece on the debt certificate explains what it says and who may ask for it.

The noticeboard, the reception desk and the three-day rule

The Act does let a community post a notice about you on the board, in one situation. Article 9.1.h obliges every owner to give the secretary el domicilio en España a efectos de citaciones y notificaciones de toda índole relacionadas con la comunidad — a domicile in Spain for summonses and notices of every kind related to the community — and, failing that, the flat itself is the domicile. Then: Si intentada una citación o notificación al propietario fuese imposible practicarla en el lugar prevenido en el párrafo anterior, se entenderá realizada mediante la colocación de la comunicación correspondiente en el tablón de anuncios de la comunidad, o en lugar visible de uso general habilitado al efecto — if a summons or notice attempted on the owner cannot be served at that place, it is deemed served by posting the communication on the community's noticeboard, or in a visible place of general use set aside for it — con diligencia expresiva de la fecha y motivos por los que se procede a esta forma de notificación — with a note stating the date and the reasons for this form of notice — signed by the secretary and approved by the president, and the notice producirá plenos efectos jurídicos en el plazo de tres días naturales — takes full legal effect after three calendar days. The AEPD's FAQ turns the article into its only permission: the debtor's name podrá publicarse únicamente en el supuesto recogido en el artículo 9 de la Ley de Propiedad Horizontal apartado h) párrafo segundo — may be published only in the case of article 9.h, second paragraph — and Para proceder de esta forma deberán acreditarse los intentos de notificación — to proceed this way the attempts at notification must be documented. Then a line every resort on this island should read twice: El tablón de avisos no deberá colocarse en un lugar de tránsito fácilmente accesible por cualquier persona — the noticeboard must not be placed in a passageway easily accessible to anyone. A reception desk where holiday guests collect their keys is that place.

The Agency's resolutions show how literally it reads all this. A community of an apartment complex in Las Palmas province posted the notice of an extraordinary meeting, with the debtors' list attached, on the noticeboard at the complex reception, where guests and visitors passed; a notary photographed it, and the resolution of 7 March 2018 in procedure PS/00510/2017 fined the community €4,000 and dismissed its appeal. In PS/00143/2020 a community had used the board as a routine channel, alongside the post and the letterboxes, and left the notice with an owner's name and a debt of €286.81 on it for three days before any notification had failed: the Agency issued a warning, an apercibimiento, because the board is the last step, not the first. In PS/00277/2023, decided on 25 September 2023, a community had pinned a sheet headed «APARTAMENTOS PENDIENTE POR PAGAR» with five flat numbers and their arrears on a locked noticeboard, no names: €700 for breaching the confidentiality principle of article 5.1.f of the Regulation and €300 for the security measures of article 32, because a flat number is a name to everyone who lives there and the glass was no protection against anyone entering the building. And in PS/00447/2024, decided on 10 December 2024, the minutes of a meeting, with an owner's surname, initial and debt, stayed in the locked cabinet of the entrance hall for eight months: €1,000 under the same article 5.1.f, with an order that minutes never again be placed in view of owners and visitors salvo en los casos que señala la Ley de Propiedad Horizontal — except in the cases the Act indicates.

For owners abroad the practical rule is the domicile. Give the community a domicile in Spain where letters are received, ours or a relative's, so that no notice ever has to be posted on a board; and receive the notice and the minutes through the channels the AEPD calls good practice, la notificación de la convocatoria individual por correo, la inclusión en cajetín, o mediante intranet con clave y contraseña — individual notification by post, the letterbox, or an intranet with user name and password. The owners' area of the communities we administer is that intranet: the notice, the proxy form and the minutes reach every owner behind a login, and the list of article 16.2 travels inside them, never on a wall. Whether the meeting itself may one day be held online is a separate question the Congress is still debating.

The WhatsApp group

The AEPD answers the WhatsApp question in the FAQ of its sectoral guide, in two sentences. The number you gave the administrator to be reached about your flat: Si lo ha facilitado el propietario se podría utilizar en el marco de la gestión de la comunidad sin necesidad de consentimiento — if the owner provided it, it may be used within the management of the community without consent. Ahora bien, no se puede utilizar para incluir al propietario en un grupo sin su consentimiento expreso, informado y explícito — however, it may not be used to add the owner to a group without their express, informed and explicit consent. The reason is the Regulation's definition of processing, which includes comunicación por transmisión, difusión — disclosure by transmission, dissemination — because adding you to a group hands your number to every member, and consent under article 4.11 is toda manifestación de voluntad libre, específica, informada e inequívoca — any freely given, specific, informed and unambiguous indication of your wishes, which a silence is not.

What is posted in the group matters as much as who is in it. In procedure PS/00365/2023 the president of a community shared in the owners' group a private conversation with one owner and a copy of that owner's bank receipt, with name, account number and postal address; the Agency proposed €1,500 for the confidentiality principle of article 5.1.f and €500 for article 32, €2,000 in all, and the community closed the procedure on 16 January 2024 by paying €1,600 under the voluntary-payment reduction. Article 5 of the LOPDGDD is the rule the president broke: the deber de confidencialidad — duty of confidentiality — binds the controller, the processor and todas las personas que intervengan en cualquier fase — every person who takes part in any phase — of the processing, a president and a vocal included, and article 72.1.i of the same law lists its breach among the very serious infractions. Nor is a group lawful because it was made for a good reason: a community that put its cleaner in a WhatsApp group with two board members to supervise her work, and then ignored her access request, was fined €1,500 and €500 in PS/00269/2022.

In the communities we administer the administrator creates no groups. Messages go one to one, e-mail goes with the recipients in blind copy, and anything that carries a name, a debt or a document goes to the owners' area, not to a chat. A group the owners set up among themselves is their own decision and their own responsibility; the community's channels are the ones the Act describes, and the internal rules of the community may say so in writing, which spares the next president the argument.

What an owner may see, and what stays in the drawer

Article 20.e of the Act makes the administrator custodiar a disposición de los titulares la documentación de la comunidad — keep the community's documentation at the owners' disposal — and article 19.4 has the secretary keep the minute books and, durante el plazo de cinco años — for five years — the notices, communications, proxies and other documents of the meetings. The AEPD's guide reads article 20.e with the Regulation's principle of data minimisation, under which data must be adecuados, pertinentes y limitados a lo necesario en relación con los fines para los que son tratados — adequate, relevant and limited to what is necessary for the purposes of the processing (article 5.1.c). So an owner may check the accounts, the invoices and the contracts, and may know the salary the community pays its gardener with its breakdown, because that is what controlling the management requires; what an owner may not obtain is the directory with the other owners' home addresses or bank accounts, since they en nada contribuyen a la finalidad de control de la buena administración — contribute nothing to the purpose of controlling good administration — nor the employees' payslips, which carry tax domicile, bank account and union or health data. Names are a different matter: the FAQ recognises un interés legítimo de un propietario de conocer el nombre y apellidos del resto de propietarios — a legitimate interest of an owner in knowing the names of the other owners — under article 6.1.f of the Regulation, which is why the attendance list of the minutes and the name on the letterbox are not a breach.

Exercising your rights from abroad

Articles 15 to 22 of the Regulation give you access to the data the community holds about you, with a copy; rectification of a wrong address or quota; erasure of what is no longer needed; and the right to object, for reasons of your particular situation, to a processing based on public interest or legitimate interest, which is the right to invoke against a camera that takes in your terrace. The community must answer en el plazo de un mes a partir de la recepción de la solicitud — within one month of receiving the request (article 12.3) — free of charge, since article 12.7 of the LOPDGDD says Serán gratuitas las actuaciones — the steps shall be free — and its article 12.1 lets the rights ejercerse directamente o por medio de representante legal o voluntario — be exercised directly or through a legal or voluntary representative — so an owner in Hamburg may write through their lawyer or through us. Where the contract with the administrator says so, the administrator handles the request on the community's behalf (article 12.3 of the LOPDGDD), which is the normal arrangement.

If the community does not answer, the complaint goes to the AEPD, which first forwards it to the community with one month to explain itself and then decides whether to warn, to order or to fine. The ceiling of article 83.5 of the Regulation is €20 million, but the Agency's fines against communities of owners are the ones quoted above, hundreds to a few thousand euros, always with an order to remove the list, take down the camera or certify the change of practice; ignoring that order is itself an infraction, and one community was fined €450 in 2025 for not certifying that it had answered an owner's rectification request.

What we do in the communities we administer

Our contract with each community carries the article 28 annex, and each community keeps its record of processing activities for «propietarios» and «videovigilancia», which we draft and the president signs. Cameras are voted under article 17.3 with the number and the areas in the resolution, the sign stands at every access with the information sheet at reception in the owners' languages, the recorder sits in a locked room with two named users and overwrites itself after 30 days, and a recording of an incident leaves the building only towards the police or the court that asks for it. The notice of the meeting goes to each owner's domicile and to the owners' area, and the list of article 16.2 travels inside it; nothing is posted on a board without the failed attempts on file and the diligencia the Act describes. We create no WhatsApp groups, we answer rights requests within the month in the owner's language, and when an owner abroad asks who has their number, we can show them. Unpaid fees are claimed through the court, with the certificate the Act describes, never through a list on a wall. Our community administration service describes the standard; ask for a quote and tell us how many cameras your resort has, because that is where the first questions usually start.

Common questions

Can the community post the list of owners in arrears on the noticeboard?

Not as a list. The Act publishes the arrears in two documents only, the notice of the meeting (article 16.2) and the minutes (article 15.2), which every owner receives. A notice about one owner may be posted on the board only after a notification at that owner's domicile has failed, with the secretary's dated diligencia, and the AEPD adds that the board must not stand where the public passes. A list of flat numbers without names was fined €1,000 in 2023.

My neighbour has installed a camera on his terrace that covers the pool. Is that legal?

No. A camera over a common area needs the resolution of the owners' meeting, under the three-fifths majority of article 17.3, and may film only the common areas the resolution names; a private camera may not take in the pool, the courtyard or the landing. The AEPD's resolution of 23 January 2026 on a La Laguna building ordered exactly such cameras removed within 15 working days. Ask the administrator to raise it with the owner in writing; if the camera stays, a complaint to the AEPD is the route.

The president added me to the community WhatsApp group without asking. Is that allowed?

No. The AEPD's guide says the number you gave the community may be used to contact you about the community, but not to add you to a group without your express, informed and explicit consent, because the group discloses your number to every member. Ask to be removed and to receive the notices by post, e-mail or the owners' area; a president who posts an owner's bank receipt or private messages in the group exposes the community to a fine, as PS/00365/2023 shows.

My car was scratched in the garage. Can I get the recording?

You can ask the community to preserve it and to hand it to the police or the court, not to give it to you: article 22.3 of the LOPDGDD keeps images only to prove acts against persons or property and sends them to the authority within 72 hours, and the recorder deletes everything within a month. Write to the administrator the same week with the day and the hour, file the denuncia, and let the police request the clip; a copy handed to an owner would show the other people in the frame.