Under Section 169 of the Companies Act 2014, as amended, every company is required to keep a register of the company's members containing details of, amongst other things, the names and addresses of each member. The Act provides that an Owners’ Management Company (OMC) must keep a register of its members, which must be made available by the company for inspection without charge. In addition, Section 216 (11) Companies Act 2014 provides that a member may request a copy or a copy of any part of the members' register. It should be noted that members have a right to access only the members' data contained in the register and not any other data.

Directors of an OMC may also wish to consider safeguards that any such request for a list of all registered members of the OMC is in good faith and that if the personal data of the registered members are to be further processed in any way, then that should only be, for a necessary lawful purpose and in line with all the principles of data protection laid out under Article 5 of the General Data Protection Regulation (GDPR).

As there is a specific statutory basis for the provision of this data in these specified circumstances no data protection issue arises. The data controller’s lawful basis for processing personal data in this manner is under Article 6(1)(c) of the GDPR which provides for the lawful processing of personal data when processing is necessary for compliance with a legal obligation to which the data controller is subject.