At the Threshold: Data Due Diligence for Smart Entrances in Managed Blocks

The entrance to a modern block is no longer simply a door. It is a sequence of connected devices: an intercom with a camera, a fob reader or mobile credential, a parcel locker with occupancy sensors, perhaps a doorbell that records audio and video. Each element can make daily life easier. Each also creates a record. For anyone buying or renting in a managed building, the threshold is now a data boundary as well as a physical one.

What the threshold records

Smart doorbells and video intercoms may capture images and sound from communal corridors, lift lobbies and the street. Access-control systems log the time, date and credential used at each door, and may associate that credential with a named resident or visitor. Parcel-room sensors record when a locker is opened, which unit collected a delivery and sometimes an image of the courier. Vehicle barriers with automatic number-plate recognition create movement records. Individually, these are modest. Combined, they can reveal attendance patterns, visitor frequency, delivery habits and periods when a home is empty.

Who controls the data

Under the UK GDPR, an organisation that decides why and how personal data is processed is a controller. In a managed block, the landlord or managing agent will often be controller for security and access logs. A device vendor or cloud platform may be a processor, acting on instructions. Some suppliers provide analytics or marketing services and may seek to act for their own purposes; that changes the relationship and should be disclosed. Where a leaseholder installs a doorbell that overlooks a communal area, responsibility can be shared or unclear. Biometric entry, such as fingerprint or facial recognition, requires particular care because it involves special category data.

Lawful basis matters. Security is often handled under legitimate interests, access services under contract, and biometrics may require explicit consent or another specific condition. A data protection impact assessment is expected where monitoring is systematic. Entrances should carry a privacy notice, and residents should be able to exercise subject access and objection rights. A notice that simply says CCTV in operation is unlikely to be enough for a connected entrance with multiple sensors.

The lease and tenancy paperwork

Leases and tenancy agreements increasingly refer to connected equipment, building rules and data sharing. Check whether the landlord or managing agent has power to install new devices, alter access systems or share data with third parties. Look for clauses on service charges for monitoring, cloud storage and maintenance. In new-build estates, estate management regulations may cover communal doorbells, parcel rooms and vehicle barriers. Renters should ask for the building privacy notice and any data-sharing schedule before signing. The tenancy may require use of an app for access; confirm what happens if a resident does not have a smartphone or prefers not to use one.

Parcel-room operators are sometimes separate companies with their own terms. A locker notification may involve the retailer, courier, locker operator and managing agent. Each may hold different data for different periods. Ask who is responsible for what.

Questions to ask before exchange or signing

• Which devices are installed at the entrance, and what do they capture: video, audio, images, credential IDs, number plates or parcel events?
• Who is the data controller and who are the processors? Is there a written data-processing agreement?
• Where is the privacy notice, and does it cover residents, visitors and couriers?
• What are the retention periods for footage, access logs and parcel records?
• Who can view the data, and is access audited?
• Is audio recording enabled? Is biometric entry used, and can residents opt out?
• Is data stored in the UK or transferred elsewhere? What safeguards apply?
• Has a data protection impact assessment been carried out?
• How are subject access requests and objections handled?
• What happens to data when a resident leaves or a tenancy ends?
• Are subscriptions, cloud storage and maintenance included in the service charge?
• What happens if the vendor withdraws support or the system fails?
• Can residents install their own doorbells, and where are they permitted?
• Are cameras positioned to avoid overlooking private homes or gardens?

These questions are not a substitute for legal advice. They are a way to test whether the connected entrance is governed as carefully as it is marketed.

Handover, service charges and proportionate caution

At handover, data should not move casually with the keys. New residents should receive the current privacy notice and understand how to request access to their own records. Former residents' data should be deleted in line with the retention schedule. For leaseholders, the service charge should show the recurring cost of connectivity, storage and monitoring. A system that is cheap to install but expensive to maintain is not a neutral amenity.

None of this argues against connected entrances. They can improve security, reduce parcel theft and make access more convenient. The point is that convenience has a data dimension. Buyers and renters should treat the entrance as part of due diligence, alongside surveys, service-charge accounts and building safety information. If the answers are vague, that is itself a finding. In 2026, a smart entrance is only as trustworthy as the paperwork behind it.