Condo managers: do you need residents' consent?

Building management companies handle resident data almost every day: names and unit numbers for service-charge invoices, licence plates for car-park stickers, resident lists for the security guards at the gate. The question property managers hear most is whether every unit has to sign a consent form first.

Company Kh. (the PDPC Office anonymises requesters with Thai letters), which provides building management and other contracted services, put this question to the Office of the Personal Data Protection Committee. It added a second one that matters to almost any business: the names and phone numbers of the client-side employees it deals with. A special subcommittee set up to answer questions and advise state agencies on implementing the PDPA considered both and replied.

The opinion is listed on the PDPC Office's advisory opinions page, and the original Thai text is in the Company Kh. opinion file. We summarised it briefly in eight more PDPC answers; this article goes through each point in detail.

Is a condo management company a data controller or a data processor?

Under the Company Kh. opinion, a firm hired to manage a condominium or housing estate is a data processor. It collects, uses and discloses resident data on the instructions of, or on behalf of, the juristic person. It does not decide for itself which data to collect or why.

The PDPC gave the same answer whether the firm is hired as the manager of the condominium or estate juristic person, or is not the manager but is contracted to run the building or estate. The tasks the opinion lists are issuing invoices, security, putting personal details on car-park stickers, keeping the resident register and other related services.

The other half of the definition is the data controller. Section 6 of the PDPA describes it as the person or juristic person with the power and duties to decide on the collection, use or disclosure of personal data. The opinion uses that test to separate the two sides: the juristic person decides, the management firm carries out.

The opinion is published in Thai only. The passage above concludes that the company is therefore not a data controller but a data processor under the PDPA.

Do residents have to sign consent for the management company?

Not on the company's side. The PDPC found that a firm acting as a data processor needs neither consent nor its own lawful basis under Section 24 or Section 26, because that duty belongs to the condominium or estate juristic person.

In English: collecting data on a proper lawful basis is the data controller's duty, not the data processor's. So the lawful-basis question does not disappear; it sits with the juristic person, which the opinion says must collect the data lawfully under the conditions the law sets. A manager who tells residents that the PDPA simply does not apply has got only half of the answer.

Some of the questions the juristic person has to answer are covered in our other pieces, such as face-scan entry to a condominium and CCTV in offices, shops and condominiums. For choosing a basis in general, see the lawful basis guide.

What does the management company still owe under the PDPA?

No consent requirement does not mean no duties. The opinion states that the company must follow the juristic person's instructions on collecting, using and disclosing data under Section 40(1), and carries the other duties the PDPA places on a data processor.

Section 40 has two more items in the same paragraph. Item (2) requires appropriate security measures and notice to the controller of any personal data breach. Item (3) requires records of processing activities, kept under rules set by the Committee.

For a building manager, item (2) means the resident register, the owner list spreadsheet and the visitor logbook all need someone deciding who can open them. If data leaks on the company's side, the notification order is set out in when a processor causes a breach, who notifies whom.

Using resident data outside instructions makes the company a controller

This paragraph is where a management company is most exposed. Suppose the company texts residents an advert for its own air-conditioner cleaning service. That use did not come from the juristic person's instructions, so the company is treated as the data controller for it and needs a lawful basis of its own.

That example is our team's reading of Section 40; the Company Kh. opinion does not discuss it. The opinion does, however, build the company's role on Section 40(1), the same item that paragraph two refers to.

The agreement between the juristic person and the management company

The opinion applies this paragraph directly: the juristic person, as controller, must put an agreement in place with the company. A management firm working without one cannot tell how far its instructions reach, and risks drifting into the controller role under paragraph two without meaning to. A clear agreement protects the company as well.

What the agreement should cover is set out in the processor agreement clauses you cannot leave out and the processor agreement guide. In AIPDPA, a data processing agreement is one of 40 ready-to-use documents in Thai and English. See the demo account.

Do you need consent for a client's staff names and phone numbers?

No, in neither of the two cases the PDPC addressed, but the basis differs depending on whether the company's counterparty is an individual or a juristic person. This part applies to any business that deals with suppliers and customers, not just building managers.

Company Kh. framed the question around the condition in Section 24(3) that the data subject must be a party to the contract. Most people the company deals with every day are employees or agents of the contracting party, not parties themselves, so it asked whether it needed their consent.

Individual counterparties: the contract basis works

The opinion adds that the contract basis also covers collecting data before a sale of goods or services is signed, where it is done at the individual's request, without the need for consent. As a hypothetical: a freelance maintenance technician hired per job, or a unit owner asking for a cleaning quote. Both are, or are about to be, parties themselves, so the company can hold the name, number and address that the job needs on the contract basis.

Corporate counterparties: their staff are not parties to the contract

In English: those people are not the company's contracting parties, so it cannot rely on the contract basis to collect their data. The PDPC points instead to legitimate interests under Section 24(5), for keeping the names, phone numbers and related details of a corporate client's employees or agents in order to coordinate, and to send quotations and documents they ask for.

The opinion attaches a caution: the controller should take care to protect the data subject's interests, prevent direct harm to them, and avoid using the data beyond what people normally expect in business dealings.

In practice, using a client's purchasing officer's number to chase a job, send a quote or book an inspection sits within normal expectations. Adding the same number to a group company's promotional list, or passing it to another firm, is a different matter that needs fresh thought. That line is our team's view, not wording from the opinion.

Before relying on Section 24(5), write the balancing test down. The method is in three questions for legitimate interests and the legitimate interest assessment guide.

Building tasks: which basis, and who is responsible?

These are hypothetical examples analysed by the AIPDPA team using the reasoning of the Company Kh. opinion and Sections 24 and 40. Real cases depend on the facts and on each building's agreement.

What should the juristic person and the management company do, in order?

The order below is the AIPDPA team's summary of the opinion and Section 40, not a procedure the PDPC prescribes. Use it as a checklist when a new building management contract starts or an old one is reviewed.

1. The juristic person lists every task that uses resident data: invoices, the resident register, car-park stickers, access control, CCTV.
2. The juristic person sets the lawful basis for each task under Section 24 or Section 26, since the opinion places that duty on the controller.
3. The juristic person signs an agreement with the management company under Section 40 paragraph three, stating which data, for which tasks, and that no other use is allowed.
4. The company keeps the instructions it receives in writing and checks with the juristic person before doing anything outside them.
5. The company keeps records of processing activities under Section 40(3), unless it falls within the small-organisation exemption in paragraph four of the same section.
6. Rights requests that residents bring to the management office are passed to the juristic person through the channel the agreement sets.

A firm that manages many buildings usually runs the same activities at each one. The AIPDPA RoPA register records them activity by activity and prints a Section 39 report, so each juristic person sees its own list clearly.

How far does this opinion reach?

The PDPC answered on the facts Company Kh. gave: it was hired and acted on the juristic person's instructions. A firm that decides for itself what to collect and why, for example by running its own app that residents sign up to directly, is in a different position and may have a different role. An advisory opinion is a view given to the person who asked, not a court judgment.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)