Subject access requests: a guide for housing associations

What a subject access request is

Article 15 of the UK GDPR gives every person the right to find out whether an organisation is using their personal data, to get a copy of it, and to be told how it is used. A request to exercise that right is a subject access request, often shortened to SAR or DSAR.

The right applies to every housing association, whatever its size, because every housing association holds personal data about tenants, leaseholders, applicants, staff and contractors. Most housing associations in England and Wales are not public authorities under the Freedom of Information Act 2000, so they do not receive freedom of information requests. Subject access applies regardless. In Scotland, registered social landlords have also been covered by the Freedom of Information (Scotland) Act 2002 since November 2019.

Recognising a request

There is no required form or wording. A valid request can be:

• made verbally, by phone or in person, as well as by email, letter, web form or social media
• sent to any member of staff, not only the data protection team
• worded in everyday language, such as "send me everything you have on me", without mentioning data protection
• part of a wider complaint, a repair report or a solicitor's letter

You can offer a form to make requests easier to handle, but you cannot insist on it. The clock starts when the request reaches anyone in the organisation, so housing officers, repair call handlers and neighbourhood teams all need to know how to spot one and where to send it on the same day.

Time limits

You must respond without undue delay and within one calendar month. The ICO's method for counting is:

• The month starts on the day you receive the request, whether or not that is a working day.
• The deadline is the corresponding date in the next month. A request received on 3 September is due on 3 October.
• If the next month has no corresponding date, the deadline is the last day of that month. A request received on 31 January is due on 28 February, or 29 February in a leap year.
• If the deadline falls on a weekend or bank holiday, it moves to the next working day.

If you need proof of identity, the month starts when you receive it. Under the Data (Use and Access) Act 2025, if you process a large amount of information about the person and reasonably need them to clarify what they are asking for, the clock pauses until they reply.

You can extend the deadline by up to two further months if the request is complex or the person has made several requests. You must tell them within the first month that you are extending, and why.

Identity and representatives

You can ask for information to confirm who the requester is, but only what is reasonable and proportionate. If a tenant writes from the email address already on their file and refers to their tenancy, you may need nothing more. Asking everyone for a passport and two utility bills is likely to be excessive, and delays the response.

Someone can make a request on another person's behalf, for example a solicitor, an advocate, a family member or a person holding a power of attorney. Check that they have the person's authority, usually a signed authority or the legal document, before you disclose. Solicitors acting in disrepair claims routinely send requests with a signed client authority attached.

A child's personal data belongs to the child. A parent can make a request for a young child, but where a child is mature enough to understand their rights, consider whether they have authorised it and whether disclosure is in their interests.

Fees and refusals

A subject access request is normally free. You can charge a reasonable fee for the administrative cost, or refuse to respond, only if the request is manifestly unfounded or excessive. You can also charge a reasonable fee for further copies of information already provided.

The bar is high. A request is not manifestly unfounded just because the person is in dispute with you, intends to bring a claim, or has asked for a lot. If you refuse, you must tell the person why, and that they can complain to the ICO or go to court, within the one-month time limit. Keep a record of your reasoning.

Searching

You must make reasonable and proportionate searches for the requester's personal data. The Data (Use and Access) Act 2025 put this standard into law. In a housing association, the places to search usually include:

• email, Teams chats and channels, OneDrive and SharePoint
• the housing management system: tenancy, rent account, arrears and notes
• repairs and asset systems: jobs, inspections, photos and contractor notes
• CRM and contact centre records, including call recordings
• antisocial behaviour, safeguarding and support case files
• CCTV and body-worn camera footage, where it is still held
• HR records, for staff and former staff
• paper files held in offices and archives

Search for the requester's name and its variations, their address, tenancy or payroll number, phone numbers and email addresses. Record where you searched, the terms you used and the date range. If you later need to show the ICO that your search was reasonable, that record is the evidence.

What to provide

The requester is entitled to a copy of their personal data, not to copies of every document that mentions them. In practice, providing documents with other information redacted is often the clearest way to give them their data in context.

Alongside the copy, you must tell them:

• why you use their data
• the categories of data concerned
• who you have shared it with, or will share it with, including any recipients outside the UK
• how long you will keep it, or how you decide
• their rights to rectification, erasure, restriction and objection
• their right to complain to the ICO
• where the data came from, if not from them
• whether you make automated decisions about them, including profiling, with meaningful information about the logic involved

Much of this is in your privacy notice, which you can refer to. If the request was made electronically, give the response in a commonly used electronic format unless the person asks otherwise.

Other people's information

Housing records are full of other people: neighbours who complained, joint tenants, household members, witnesses, contractors and staff. Under Schedule 2 to the Data Protection Act 2018, you do not have to disclose information that identifies someone else unless they have consented, or it is reasonable to disclose it without their consent.

Deciding whether it is reasonable means weighing the circumstances: any duty of confidence, what the other person would expect, whether they have refused consent, whether the information is already known to the requester, and the risk of harm. Information about staff acting in their professional role is often reasonable to disclose. A neighbour's name and statement in an antisocial behaviour case usually is not.

Exemptions

Schedule 2 to the Data Protection Act 2018 sets out exemptions that let you withhold some information. Those most relevant to housing associations include:

• Legal professional privilege: advice from your lawyers and documents prepared for litigation
• Crime and taxation: where disclosure would be likely to prejudice preventing or detecting crime, or apprehending offenders
• Negotiations: your intentions in negotiations with the requester, such as a settlement, where disclosure would prejudice them
• Management forecasting: planning that would be prejudiced by disclosure
• Confidential references you have given

Exemptions apply to specific information, case by case, not to whole files or whole categories of request. Record which exemption you relied on and why, and tell the requester you have withheld information unless doing so would itself cause the prejudice.

Redaction

Redaction must remove information, not hide it. Black rectangles drawn over text in a PDF, or text coloured to match the background, can often be copied out or revealed by anyone who opens the file. Disclosures go wrong this way every year.

Proper redaction removes the underlying text and data, including from hidden layers, metadata, comments and tracked changes. Check the final files, not the working copies, before they go out. Keep an unredacted copy and a record of what was removed and why.

Requests in housing

Disrepair claims

Solicitors acting for tenants often send a subject access request alongside, or ahead of, a disrepair claim. In England, the Pre-Action Protocol for Housing Conditions Claims has its own early disclosure process for the landlord's documents, which runs separately. Treat the two as distinct requests with their own rules and deadlines, and keep the responses consistent.

Damp and mould

Complaints about damp and mould are frequently followed by a request for every inspection report, photo, message and repair record. In England, Awaab's Law now sets legal timescales for social landlords to investigate and fix certain hazards. Your records of how quickly you acted are likely to be scrutinised, so search repairs and asset systems thoroughly.

Antisocial behaviour

ASB case files hold other residents' complaints, diaries and statements. Expect a lot of third-party information to weigh, and consider whether the crime and taxation exemption applies where a police investigation is ongoing.

Complaints and the Housing Ombudsman

Residents escalating a complaint often ask for the records behind it. A subject access request runs on its own statutory timetable, alongside your complaints process, not instead of it.

Staff and former staff

Employment disputes are a common source of requests, and they tend to be broad, covering years of email and Teams messages. From 1 October 2026 most employment tribunal claims in England and Wales can be brought within six months, up from three, so expect requests from leavers over a longer period.

Checklist

1. Log the request and the date received. Set the deadline.
2. Acknowledge it, and confirm what you need, if anything, to verify identity or authority.
3. Clarify the scope only if you genuinely need to, and record when you asked and when they replied.
4. Search every relevant system and record where, how and when you searched.
5. Gather the results and remove duplicates.
6. Review for third-party information and exemptions, and record each decision.
7. Redact properly and check the final files.
8. Prepare the covering letter with the supplementary information.
9. Send the response securely, by the deadline.
10. Keep the case record: what was searched, found, withheld and sent.

If someone is unhappy with your response, they can complain to you, then to the Information Commissioner's Office, or apply to court. The Data (Use and Access) Act 2025 also requires organisations to have a process for handling data protection complaints.

For the regulator's full guidance, see the ICO's guidance on subject access requests.

Questions