An HOA or housing cooperative managing personal data on the basis of a legal regulation does not need the consent of the data subject to carry out its activities (Article 6(1)(c) GDPR). For HOAs this is Act No. 89/2012 Coll. (Civil Code), for housing cooperatives it is Act No. 90/2012 Coll. (on companies and cooperatives).

There are two types of data processed: those that require the consent of the subject and those that do not. The HOA should minimise the processing of data requiring consent, as it is administratively demanding and the subject can withdraw consent at any time.

For most of the data necessary for the operation of the SAU, consent is not required as the processing is required by law (GDPR Art. 6(1)). The Code requires the maintenance of a list of owners and persons to whom the apartment has been transferred. However, publishing this data on a notice board or on the internet is prohibited. The notice board should only contain general information, not personal data.

The HOA may process bank details for billing, which is a legal obligation. It may also process data on statutory bodies, such as place of birth, surname and ID number. This data must not be made public and must be protected.

Without consent, SVJ can process data:
- Necessary for the performance of the contract
- For the legitimate interests of the SVJ
- Insofar as they do not conflict with fundamental rights and freedoms

Controllers and processors should not unnecessarily require consent to process data where the processing is lawful. Requiring consent in these cases is unnecessary and contrary to the GDPR.

HOAs and housing associations must ensure compliance with the GDPR, inform data subjects about processing and carefully select processors that comply with data protection requirements. Redundantly requiring consent must be avoided, and all processing of personal data must be properly recorded and protected.