GDPR in student accommodation or a hall of residence in Spain: a practical guide for 2026
Student accommodation handles more personal data than its team usually counts: identifying, academic, financial, health, comings and goings, and community-life data. Here is which lawful basis supports each group, how long it can be kept, and where the three most repeated mistakes are.
What data a residence actually processes
The first useful exercise isn't legal: it's taking the inventory. Categories almost always turn up that nobody had counted, and they are precisely the ones left out of the record of processing activities and of the deletion schedule.
| Category | Usual lawful basis | Note |
|---|---|---|
| Identifying and contact data | Performance of the contract (Art. 6(1)(b)) | Name, ID document, phone, email, family address. |
| Family or guardian contact | Legitimate interests or contract | This is a third party's data: they have to be informed too (Art. 14). |
| Financial and billing data | Contract and legal obligation (Art. 6(1)(b) and 6(1)(c)) | They drag in their own tax and accounting retention periods. |
| Accommodation and access | Contract and legitimate interests | Room assigned, keys, and the record of comings and goings where one exists. |
| Health (allergies, medication) | Art. 9(2) as well as Art. 6 | Special category. Restricted access and its own retention period. |
| CCTV images | Legitimate interests (Art. 22 LOPDGDD) | One month's retention at most, with narrow exceptions. |
| Incidents and community life | Legitimate interests or legal obligation | The most delicate: it mixes several people's data in a single file. |
Indicative. The specific basis depends on how each service is set up.
The mistake of asking for consent for everything
It is the most widespread failing and the easiest to fix. Many centres start the stay with a form asking for consent to process the resident's data. For nearly all of it, that consent is unnecessary: housing someone, charging them and providing the service rests on performance of the contract (Art. 6(1)(b) GDPR).
Ojo con esto
Consent has a property the other bases don't: it can be withdrawn at any moment. If the centre says it processes billing data «with your consent» and someone withdraws it, it is left in an impossible position: either it breaks what it promised or it admits the basis was something else. Choosing the basis well at the start avoids that conversation entirely.
Consent is saved for what is genuinely optional: posting a photo on social media, sending marketing communications, processing health data, or sharing information with the family of a resident who is of age.
Health data: the case of allergies
A residence with a dining hall processes health data even if it doesn't call it that. A food allergy, an intolerance or a medication schedule are a special category under Art. 9 GDPR, and that changes three things at once.
- A basis under Art. 9(2) is needed as well as the one under Art. 6. In this context it is usually explicit consent.
- Access is restricted to those who have to use it: the kitchen and whoever coordinates the dining hall. Not the whole team, and certainly not a messaging group.
- The retention period is its own and normally shorter than the file's: when the person leaves the centre, the health data stops making sense before the invoice does.
CCTV and common areas
Art. 22 of the LOPDGDD, Spain's data protection act, is short and specific. Images are kept for a maximum of one month from capture, unless they have to be kept to evidence acts against the integrity of people, property or premises. The area has to be signposted with the corresponding information notice. And there can be no cameras in places set aside for staff rest or recreation.
In a residence there is also a boundary of its own that the law doesn't spell out and common sense does: bedroom corridors and washing areas are not just any common area. The closer to private space, the harder it is to argue that legitimate interests outweigh the privacy of the person living there.
The centre's messaging groups
A phone number is personal data. Set up a group with the sixty residents of a floor and each one now sees the numbers of the other fifty-nine: that is a disclosure of data between them, made by the centre. It isn't prohibited, but you have to inform people and have a basis that covers it.
The practical problem arrives before the legal one. A group is no use for anything confidential — a personal situation, a piece of health data, a conflict between two residents — and yet that is where those conversations end up, because it's the channel people have open. A broadcast list, where nobody sees anyone else's number, solves the data part; the confidentiality part needs a different route.
Deadlines, rights and breaches
- Individuals' rights: one month to respond from the request, extendable by two further months if it is complex, giving notice within the first month (Art. 12(3)). The clock runs even if the person no longer lives there.
- Minors: Art. 7 of the LOPDGDD sets fourteen as the age from which a person can consent to the processing of their own data.
- Suppliers: anyone processing data on the centre's behalf — the management software, the catering company, the accountants — is a processor and needs an Art. 28 contract.
- Security breaches: seventy-two hours to notify the supervisory authority from becoming aware, unless the breach is unlikely to result in a risk (Art. 33).
- Record of processing activities: Art. 30 requires keeping one, and it is the document the Agencia Española de Protección de Datos, Spain's data protection authority, asks for the moment there is a complaint.
The data protection officer
Here this guide gives no closed answer, because there isn't one. Whether a hall of residence or a student residence is required to appoint a DPO depends on Art. 37 GDPR and Art. 34 of the LOPDGDD, and the fit changes with its legal form and with its relationship to the university — integrated, affiliated or independent. It is one of the few things on this list worth checking with the centre's own adviser rather than settling by analogy with another.
Frequently asked questions
Is the resident's consent needed to process their data?
For most processing, no, and asking for it is a frequent mistake. The data needed to house someone, invoice them and provide the service is processed on the basis of performance of the contract (Art. 6(1)(b) GDPR). Consent is reserved for what is genuinely voluntary: posting a photo, sending marketing communications or processing health data. Asking for consent for something that is going to happen anyway creates the false expectation that it can be withdrawn.
Can a resident's food allergies be stored?
Yes, but they are health data and therefore a special category under Art. 9 GDPR. They need a specific basis under Art. 9(2) — normally explicit consent — as well as the general basis under Art. 6, access restricted to those who have to use them (the kitchen and whoever coordinates the dining hall), and a defined retention period. They are not collected «just in case» nor shared in the team's group chat.
How long can CCTV images be kept?
One month from capture, under Art. 22(3) of the LOPDGDD, unless they must be kept to evidence acts against the integrity of people, property or premises. Art. 22 also prohibits installing cameras in places set aside for staff rest or recreation, and the monitored area has to be signposted.
Is a WhatsApp group with all the residents lawful?
A phone number is personal data, and creating a group means each participant sees everyone else's number: that is a disclosure of data between them. It isn't prohibited, but it requires informing people and having a basis that covers it, and it doesn't work as a channel for confidential matters or health data. Broadcast lists, where nobody sees anyone else's number, avoid the problem at the root.
Does a seventeen-year-old resident need their parents' authorisation?
It depends on the exact age. Art. 7 of the LOPDGDD sets fourteen as the age from which a person can consent to the processing of their data on their own. Below that, authorisation is needed from whoever holds parental responsibility or guardianship. Note: that affects consent, not the capacity to sign the accommodation contract, which is a separate question.
How long is there to answer a resident asking for their data or its deletion?
One month from receiving the request, extendable by two further months if the request is complex or if there are many, giving notice of the extension within the first month (Art. 12(3) GDPR). The clock runs even if the person no longer lives at the centre.