Cybersecurity Basics for a Self-Managed Strata Council

Self-management puts the strata corporation's records, banking and owner data in the hands of volunteers using personal laptops and free email. That is workable — there is no requirement under the Strata Property Act to hire a property manager — but it does mean the council is the IT department. Strata cybersecurity is less about firewalls than about habits: who can see what, who can authorize money, and what happens when a council member resigns.

Why this is a governance problem, not an IT hobby

The corporation holds real personal information: names, unit numbers, contact details, arrears, insurance claims, bylaw complaints. BC's Personal Information Protection Act applies to organizations including strata corporations and generally requires reasonable security arrangements for personal information in their custody — a point worth confirming with a privacy-aware advisor for your situation.

The Act also creates duties that depend on records surviving. On request, the strata must make records available and provide copies to an owner, to a tenant assigned that right, or to someone either authorises in writing, within 2 weeks — except bylaws or rules, which must be provided within one week (Strata Property Act s.36). You cannot meet that deadline from a ransomware-locked laptop or a departed treasurer's personal Gmail.

Retention periods vary by record type under Strata Property Regulation s.4.1: minutes of general and council meetings, books of account, budgets and financial statements must be kept at least 6 years; correspondence at least 2 years; depreciation reports and electrical planning reports permanently; while only a current copy of the bylaws, rules, council list and owner list is required. Different clocks, same lesson — a single copy on one device is not a records system. Our guide to document management for self-managed stratas covers the filing side in more detail.

Strata phishing: the attacks councils actually see

Strata phishing rarely looks exotic. The common patterns:

• Banking-change emails — a "contractor" or "manager" emails new payment details before a deposit or progress payment.
• President/treasurer impersonation — a lookalike address asking for an urgent transfer or a copy of the owner list.
• Fake records requests — someone posing as a purchaser's agent asking for financials or an owner's contact information.
• Credential harvesting — a "shared document" link that asks you to re-enter your email password.

Controls that work without a budget:

• Verify by voice, on a number you already had. Never a number in the email.
• Two people on every payment. If the council delegates spending, Standard Bylaw 20 requires it be done by resolution that either authorizes a specific amount for a specific purpose, or sets a maximum amount and the purposes or conditions for spending — and the council cannot delegate decisions on whether a person contravened a bylaw, whether to fine, or the amount.
• Multi-factor authentication on every email and banking login.
• Least privilege. Not every council member needs the bank, the owner list and the insurance file.

Q&A: what the Act does and doesn't say

Does the Strata Property Act require a cybersecurity policy? No. Neither the Act nor the Standard Bylaws set IT security requirements. The pressure comes indirectly — records access deadlines, retention rules, and privacy law. Most councils adopt this as a written council practice rather than a bylaw. If your strata does want it in the bylaws, remember a bylaw amendment has no effect until it is filed in the Land Title Office, and owners and tenants must be informed as soon as feasible after approval (s.128).

Can we meet electronically and keep sensitive items private? Yes. Under Standard Bylaw 17, council meetings may be held by electronic means at the council's option so long as all participants can communicate with each other, and members are then deemed present in person. Owners may attend as observers, but not the portions dealing with bylaw contravention hearings under s.135, or other matters where observers would, in the council's opinion, unreasonably interfere with an individual's privacy. Use a waiting room and a separate link for those portions. Separately, since November 24, 2022, all BC strata corporations may hold electronic or hybrid general meetings and accept electronic votes without passing a bylaw.

What should we do when a council member leaves? Treat departure as an access event. Whether a member is removed by majority vote at a general meeting or replaced by the remaining members, access should be revoked the same week and records returned to the corporation's own storage — not left in a personal account.

A baseline a volunteer council can actually maintain

• Use corporation-owned accounts (council@yourstrata), not personal email, for strata business.
• Keep the authoritative copy of minutes, contracts and financials in shared storage with backups — not on one device.
• BCC owners on mass emails; never attach the full owner list to a general notice.
• Review vendor and manager access annually, including anyone who still has portal or banking visibility.
• Write down an incident plan: who calls the bank, who notifies affected owners, who records it in the minutes.

An owner portal helps here because it replaces ad-hoc attachments with permissioned access, and AI tools such as SearchStrata can analyse strata documents so council members aren't emailing PDFs around to find an answer. ManageStrata is built on the same premise: the management company can change, but the strata's knowledge shouldn't — the documents, minutes, votes and books belong to the corporation and should still be there when the manager or the council does.

This article is general information about BC strata law, not legal advice; verify against the current Strata Property Act and Regulation or consult a BC strata lawyer.