It depends on who sets it up and what it is for. If a neighbour creates the group on their own, Spain's data protection authority (AEPD) generally treats it as a personal or household activity, outside the GDPR. If the community, its president or the property manager uses it to run the building, the community is answerable for what is posted: the AEPD has opened sanction proceedings against communities for sharing a neighbour's ID card or a bank receipt there.
Does data protection law apply to a neighbours' WhatsApp group?
The General Data Protection Regulation (GDPR, RGPD in Spanish) does not apply to processing "efectuado por una persona física en el ejercicio de actividades exclusivamente personales o domésticas" (carried out by a natural person in the course of a purely personal or household activity) (article 2.2.c). Its recital 18 gives as examples "la correspondencia y la llevanza de un repertorio de direcciones, o la actividad en las redes sociales" (correspondence and keeping an address book, or social networking), always "sin conexión alguna con una actividad profesional o comercial" (with no connection to a professional or commercial activity).
The Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) applies this to messaging. Its FAQ on messaging apps puts it plainly: "Con carácter general, el envío de datos personales entre particulares en el ámbito de la vida privada mediante servicios de mensajería instantánea (por ejemplo, WhatsApp o Telegram) se considera que es una actividad personal o doméstica, por lo que queda excluida de la aplicación de la normativa de protección de datos" (as a general rule, private individuals sending personal data to each other in their private lives through instant messaging such as WhatsApp or Telegram is considered a personal or household activity, so data protection law does not apply). It then adds the exception: it may step in if the data are spread "por una entidad o por un profesional vulnerando la confidencialidad" (by an organisation or a professional in breach of confidentiality).
For neighbours' groups it spelt this out in decision AI/00336/2023. Outside its remit are "los posibles tratamientos de datos con carácter doméstico que pudieran efectuar los vecinos al margen de las comunicaciones oficiales del órgano de gobierno de la Comunidad, particularmente la remisión de mensajes electrónicos relacionados con posibles desacuerdos en el seno de la comunidad" (any household processing that neighbours may carry out outside the official communications of the community's governing body, in particular electronic messages about disagreements within the community).
The key is in that sentence: outside the official communications. As soon as the group is used to run the community, data protection law comes into play.
Being outside the GDPR does not mean anything goes. The same decision points out that the rights to honour, privacy and one's own image under Organic Law 1/1982 are defended "ante la instancia jurisdiccional competente" (before the competent court), not before the AEPD.
Who is responsible for the group: the neighbour, the president or the community?
The AEPD sets the general rule: in communities of owners (comunidades de propietarios), "éstas serán las responsables del tratamiento de sus datos personales" (they are the controllers of their personal data), and the property manager (administrador de fincas) acts as processor (AEPD FAQ on communities). The Horizontal Property Act (Ley de Propiedad Horizontal, LPH) tasks the manager with "custodiar a disposición de los titulares la documentación de la comunidad" (keeping the community's documents available to the owners) (article 20.e).
For WhatsApp groups, three decisions show where the line is:
| What happened | Decision | Outcome |
|---|---|---|
| A neighbour's land registry extract (nota simple) with their name, surnames and ID number is posted in the community group, where there are only owners. The complaint was against the law firm that posted it, which argued it was needed to discuss an item on the agenda | AI/00336/2023 | Closed: the disclosure did not go beyond "el ámbito limitado de la relación asociativa propia de la Comunidad" (the limited scope of the community's own relationship between members) |
| The president posts, in a group "en el que están incluidos todos los copropietarios" (which includes all the co-owners), a neighbour's letter with a copy of both sides of their ID card | PS/00392/2021 | Breach of the confidentiality principle (GDPR article 5.1.f) attributed to the community. A formal warning instead of a fine, because the next day the president asked the neighbours to delete it, plus an order to take measures within three months |
| The president shares in the community group a private conversation and a bank receipt showing the name, account and address of someone outside the community, joint holder of the account with their daughter, an owner | PS/00365/2023 | Proposed fine of €2,000 for the community: €1,500 under article 5.1.f and €500 for lack of security measures (article 32). The community paid €1,600 with the reduction for voluntary payment |
The third case is the most useful. The community argued that the group "no es fruto de un acuerdo comunitario, sino como iniciativa de un propietario" (was not the result of a community resolution but an owner's own initiative), and that it had no control over what was posted. That did not help. The AEPD reasoned that the president had access to the receipts "por su condición de presidente de la comunidad" (by virtue of being the community's president) and that the community is the controller for that processing.
The outcome depends on the facts, so there is no single rule. But the pattern repeats: what the president or the manager holds because of their role and ends up in the group is the community's responsibility, even if a neighbour created the group.
Can the community add every neighbour to the group without asking?
To run the building, the community does not need each owner's consent. The AEPD explained this on its blog in 2018: its lawful basis does not come from prior consent, "sino con base en el cumplimiento de una obligación legal (el contenido de la Ley de Propiedad Horizontal)" (but from compliance with a legal obligation, the content of the Horizontal Property Act). So "no hay que solicitar consentimiento de los propietarios para tratar sus datos personales" (owners' consent is not needed to process their personal data). In decision AI/00336/2023 it adds that owners "podrían conocer legítimamente, en particular, las direcciones de contacto de otros miembros de la Comunidad" (may legitimately know, in particular, the contact details of other members of the community).
But a WhatsApp group goes beyond what the LPH requires, and the LPH does not mention messaging. Once you join a group, everyone sees your number, your profile photo and your user name. The AEPD described it this way in decision A/00163/2018: those data "resultaban accesibles a todos sus miembros desde el propio grupo" (were accessible to all its members from within the group). In that case, under the law that preceded the GDPR, someone had created a group with mobile numbers taken from websites to send holiday greetings, and the AEPD held that the person who created it was the controller. It closed the case because the group was deleted as soon as one of its members asked.
The AEPD guide for property managers, which the Agency itself marks "en revisión" (under review), points the same way: processing owners' data under an engagement for services or tasks "diferentes de las comprendidas en la LPH" (other than those covered by the LPH) requires "el consentimiento específico, informado e inequívoco de todos los afectados" (the specific, informed and unambiguous consent of everyone concerned).
Putting those pieces together, the prudent approach for an official community group is:
- Make it voluntary. Ask before adding anyone, and keep another channel (email, letter, notice board) for those who do not want to join.
- Tell people when they join. GDPR article 13 requires you to give, when collecting the data, "la identidad y los datos de contacto del responsable" (the identity and contact details of the controller) and "los fines del tratamiento a que se destinan los datos personales y la base jurídica del tratamiento" (the purposes of the processing and its legal basis). The template below includes this.
- Decide who is in. In the land registry case, it counted that there were only owners in the group. If you add tenants or relatives, whatever is posted reaches more people, so agree it at the owners' meeting (junta de propietarios).
- Only group admins add people. WhatsApp lets admins choose who can add and remove participants (WhatsApp groups page).
- Remove people who leave. The GDPR requires data that are "adecuados, pertinentes y limitados a lo necesario" (adequate, relevant and limited to what is necessary) (article 5.1.c). Someone who has sold their flat no longer needs to be there.
And if you are the one who does not want to be added to groups without being asked, WhatsApp lets you control who can add you. When it launched the setting, on its 2019 blog, it explained that you can limit this to your contacts, or to your contacts except those you exclude. A group admin who cannot add you is then prompted to send you a private invite, which expires after three days.
What should never be posted in the group?
- Documents with ID numbers, bank accounts or receipts. These are the two cases that ended in sanction proceedings against the community.
- The list of owners in arrears. Article 16.2 LPH says that the notice of the owners' meeting "contendrá una relación de los propietarios que no estén al corriente en el pago de las deudas vencidas a la comunidad" (shall include a list of the owners who are not up to date with debts owed to the community). To deliver that notice, the AEPD considers good practice to be individual delivery by post, the letterbox or a password-protected intranet, "evitándose cualquier medio que pueda suponer el acceso por terceros (Internet)" (avoiding any means that could give third parties access, such as the internet). The notice board is only valid when notice could not be delivered at the owner's address (article 9.1.h), with proof of the attempts (AEPD FAQ). In decision PS/00056/2024 the AEPD fined a community €2,000 for putting a list of debtors on the notice board and emailing lists of unpaid fees to all owners "hasta en siete ocasiones" (up to seven times), without those lists being part of the notice of any meeting. The notice board list only gave apartment numbers, and even so, for the AEPD, "el piso es un dato personal que identifica al dueño de la vivienda" (the flat is a piece of personal data that identifies its owner). We know of no decision on a list of debtors sent by WhatsApp, but the logic is the same. If you need to chase a debt, use the proper route: see how to claim unpaid community fees with the MASC and the notice template with owners in arrears.
- Health data. GDPR article 9.1 prohibits, subject to exceptions, processing "datos relativos a la salud" (data concerning health). The fact that a neighbour is in hospital or on sick leave has no place in the official group.
- CCTV footage. According to the AEPD, "el acceso a las imágenes estará restringido a las personas designadas por la comunidad de propietarios" (access to the images shall be restricted to the people designated by the community of owners) (AEPD FAQ). In decision AI/00412/2023, a block president sent, by WhatsApp and email, camera footage of some minors in the storage rooms to their parents. The AEPD closed the case because the videos went only to them and there was no evidence of a "difusión discrecional" (indiscriminate distribution) among the neighbours. It also pointed out that the president or the designated person is the one who views the cameras, who must pass footage of criminal conduct "a las autoridades competentes" (to the competent authorities) and, when warning owners about antisocial behaviour, make "uso proporcional" (proportionate use) of the images.
- Private conversations. In the bank receipt case, the AEPD found it proven that the president shared in the group "una conversación privada con la parte reclamante sin permiso ni consentimiento de ésta" (a private conversation with the complainant without the complainant's permission or consent).
Can the group be used to call the owners' meeting or give formal notice?
Not as the official channel. Article 9.1.h LPH requires each owner to give "el domicilio en España a efectos de citaciones y notificaciones de toda índole relacionadas con la comunidad" (an address in Spain for summonses and notices of any kind relating to the community). If they do not, their flat counts. Article 16.2 requires meeting notices to be given "en la forma establecida en el artículo 9" (in the manner set out in article 9). The law does not mention messaging.
Use the group to remind people of the date, not to give notice. Why a WhatsApp message is not enough as a notice, and what the courts have said, is explained in can you call an owners' meeting by WhatsApp or email?.
If the community is in Catalonia, horizontal property is governed by Book Five of the Catalan Civil Code rather than the LPH. The GDPR, on the other hand, is the same throughout Spain.
Checked in the BOE (Spain's official gazette) on 24 October 2026: the LPH was amended in 2025 and 2026, but those amendments touch other articles (7, 10 and 17, among others), not 9, 16 or 20. Article 5 of Organic Law 3/2018 (LOPDGDD, Spain's data protection act), which binds everyone involved in processing to confidentiality, remains as passed in 2018.
What rules should the community WhatsApp group have? Template
If the community wants its own group, approve some rules at the owners' meeting and put them in the group description. Adapt this template. The Spanish version of this article has it in Spanish, which is what most communities will need.
Rules of the WhatsApp group of the Community of Owners [name]
- What it is for. Practical notices about the building: water or power cuts, works, cleaning and date reminders. It is not an official channel: meeting notices, minutes, claims and formal notices are given by the means set out in the Horizontal Property Act.
- Who is in it. Owners who ask to join [and the tenants or relatives agreed by the owners' meeting]. Nobody has to join. Anyone who is not in the group will get notices by [email, letter or notice board].
- Who runs it. [The president or the property manager]. Only the group admins add or remove participants, and only with the person's prior permission.
- What is not posted. ID numbers, bank account numbers, receipts, anyone's debts, health data, footage from the community's cameras and screenshots of private conversations.
- Repairs. If it is urgent, say so in the group, but also report it to [the manager, through the right channel], who files the claim and follows it up.
- Respect. No insults or accusations against neighbours. Disputes are dealt with at the owners' meeting or with the manager.
- Leaving. Anyone who sells their home or stops living in the building leaves the group. Anyone can leave whenever they want.
- Your data. Controller: Community of Owners [name], [contact email or address]. Purpose: sending community notices through this group. Legal basis: your consent when you ask to join, which you can withdraw by leaving the group. Other participants will see your number, name and profile photo. You can exercise the rights in GDPR articles 15 to 22 (access, rectification, erasure, objection and the rest) by writing to [contact].
What about reports of repairs? Better outside the chat
The group is handy for raising the alarm, but not for managing: a message about a leak gets lost among other messages, and nobody knows who is handling it or how long it has been open. If you manage several communities, Incident management brings every incident from all your communities onto one board, with who is responsible, the supplier and how many days each has been open. A property manager in the province of Alicante has used it daily since July 2026.
If you also want neighbours to report problems by WhatsApp to a community number, that is a custom WhatsApp chatbot connected to the tools you already use, and we build those too: see automation for property managers.
Frequently asked questions
Can I report a neighbour to the AEPD for posting my data in the group?
It depends on who did it and why. If it was a private individual in their private life, the AEPD generally considers it a personal or household activity and does not step in. It may act if the data were spread by an organisation or a professional, such as the community, the president with documents held because of the role, or the manager. If what affects you is an insult or your privacy, the route is the courts, under Organic Law 1/1982.
Can I be added to the community group without being asked?
WhatsApp lets you limit who can add you to groups. For an official group, the prudent approach is for the community to ask first, because the group shows your number, name and photo to everyone, and the AEPD guide requires consent for tasks other than those under the LPH. If you are already in and do not want to be, leave and ask to be kept informed another way.
Can the list of owners in arrears be posted in the WhatsApp group?
No. The LPH provides for that list in the notice of the owners' meeting (article 16.2), and on the notice board only when notice could not be delivered at the owner's address (article 9.1.h). The AEPD fined a community €2,000 for putting lists of debtors on the notice board and emailing them to all owners outside those cases.
Is a message in the group valid notice of a meeting?
It is not the method the LPH sets out, which requires notice at the address each owner designated or, if they designated none, at their flat. Use the group as a reminder and give notice in the way article 9 requires.
Sources
- Regulation (EU) 2016/679, General Data Protection Regulation, recital 18 and arts. 2.2.c, 5.1, 9.1 and 13.1.
- Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD), art. 5.
- Law 49/1960 on Horizontal Property (Ley de Propiedad Horizontal), arts. 9.1.h, 16.2 and 20.
- Organic Law 1/1982 on the civil protection of the right to honour, personal and family privacy and one's own image.
- Law 5/2006, on Book Five of the Civil Code of Catalonia.
- AEPD FAQs: messaging apps, obligations of communities, list of owners in arrears and CCTV footage.
- AEPD, Comunidades de propietarios y administradores de fincas ante el RGPD (blog, 23 December 2018) and guide Protección de datos y administración de fincas (under review).
- AEPD decisions: AI/00336/2023, AI/00412/2023, PS/00392/2021, PS/00365/2023, PS/00056/2024 and A/00163/2018.
- WhatsApp: groups page and new privacy settings for groups (blog, 3 April 2019).
This article explains the law and published court criteria as of the update date. It is not a substitute for advice from a lawyer on a specific case.