HOA

Member lists and personal data during a HOA board change

19 November 2025 · 6 min read · DeSnipperaar

In many Homeowners Associations (HOAs) the board changes regularly: volunteers serving a term, sometimes stepping down unexpectedly, sometimes replaced after an incident. Every change means files, member lists and correspondence move into new hands. What is left in the old cabinet or on the old laptop is a GDPR problem in the making. This article describes how to navigate a board change carefully, with special attention to destroying what is no longer needed.

The HOA as controller

Legally it is not the board but the HOA (the legal entity) that is the controller under the GDPR. The board acts on behalf of the HOA. That distinction matters at a change: whatever personal data the outgoing board member holds is the property of the HOA, not of the person. The outgoing board member must hand everything over to the successor or, if a handover is not appropriate, destroy it.

See also our introduction GDPR document destruction: what is required of SMEs for the general framework.

What data is there?

An active HOA board often manages the following personal data:

• Member list with name, address, apartment index, bank account.
• Contact details: email, phone, sometimes language preference.
• Correspondence per owner about complaints, payment arrears, renovation requests.
• Tenancy details and contact details of tenants (where relevant).
• Incident reports: nuisance, leaks, disputes.
• Construction files sometimes containing personal data of contractors and suppliers.

Part of this has to be taken over by the new board member to carry out their role. Another part (draft emails, old complaint correspondence that has been resolved, personal data past its retention period) should be destroyed.

Three scenarios at a change

Scenario 1: regular end of term

At a planned change the outgoing board can draft a handover document with an inventory of what transfers and what is destroyed. In practice: an afternoon at the outgoing board member's home, all folders on the table, a checklist ticked off, the file handed to the successor, the rest in the destruction bag.

Scenario 2: conflict or unexpected resignation

Trickier. The departing board member is sometimes unwilling or unable to manage an orderly handover. Change access to the bank account, email and portals yourself. Send a polite letter asking that all HOA documents be returned or demonstrably destroyed. Document it.

Scenario 3: transition to professional management

If the HOA moves from a volunteer board to a professional manager, the archive moves to the manager's office. Between the HOA and the manager, sign a processor agreement (the HOA remains the controller). Old files at the volunteer board are destroyed at the same moment the handover is finalised.

Most data breaches at HOAs occur not during active management but in the weeks after a board change. Old folders go missing, old mailboxes stay open, old laptops end up on Marktplaats.

What to hand over, what to destroy?

A rough guide:

• Hand over: current member list, ongoing files (including pending complaints and arrears), contracts still running, keys and access.
• Destroy at outgoing board: copies of old member lists, resolved complaint correspondence, draft emails, draft versions of minutes, meeting agendas of past years.
• Move to formal archive: signed originals of general meeting minutes, annual accounts, contracts that have to be retained legally.

Do not forget the digital steps

The paper side is often visible, but a lot lingers digitally. Actions at every change:

1. Change the password of the HOA email address (if one exists).
2. Remove the outgoing board member as a user from portals of the manager, the bank, the insurer.
3. Check whether the outgoing board member's personal email still contains HOA emails. If so: hand over or destroy.
4. Laptops or external drives that held HOA data: demonstrably wipe, and at end of life physically destroy (see our article on wiping versus destroying a hard drive).

Mobile destruction at the outgoing board's address

For HOAs without a professional office, a practical solution is to visit the outgoing board member with a mobile shredder. Our destruction truck comes to the address of the outgoing board, paper goes on the street or in the car park through the cutting heads at DIN 66399 P-5. The outgoing board member receives a certificate in the name of the HOA on the spot. That certificate goes into the formal archive as evidence that the old paper stream has been closed correctly. No more boxes in the attic, no risk of being-found-by-heirs ten years from now.

In summary

• The HOA is the controller, not the individual board member.
• At every change make an inventory and a handover document.
• Hand over what is current, destroy what is duplicate or outdated.
• Do not forget the digital side: access, email, laptops.
• Mobile destruction at the outgoing board's address closes the paper stream neatly.

More information on HOA-specific destruction is on our page for HOAs and HOA managers. See also our article on retention period for HOA minutes and annual accounts.