Your right
The UK GDPR gives you the right to ask any organisation whether it holds personal information about you, and to get a copy. This is called a subject access request, or SAR. For a housing association, that can include your tenancy file, rent account, repair records, letters, emails, notes of phone calls, complaint files and anything else that is about you.
It is usually free. You do not have to say why you want it.
This page is for tenants, residents and staff asking a housing association for their information. We make software for housing associations, so the rest of this site is written for them. The ICO's guide for the public is the official source.
How to ask
- Send it in writing if you can. A request by phone or in person is valid, but an email or letter gives you a record of the date.
- Send it to the right place. Look for a data protection officer or "information governance" contact on your landlord's website or privacy notice. If you cannot find one, any member of staff can receive it.
- Say what you want. You can ask for everything, or narrow it, for example "all records about the damp in my kitchen since January 2024". Narrower requests are often answered faster.
- Include details that help them find you: your full name, address, tenancy or staff reference, and any old names or addresses.
- Keep a copy and note the date you sent it.
A letter you can copy
To the Data Protection Officer, [name of housing association]
Subject access request
I am making a subject access request under Article 15 of the UK GDPR.
Please send me a copy of all the personal information you hold about me, [or: the personal information you hold about me relating to (topic) from (date) to (date)], including information held in emails, Teams or other messages, case notes, repair records, call recordings and paper files.
Please also tell me why you hold it, who you have shared it with, how long you will keep it, and where you got it from if not from me.
My details: [full name], [address], [tenancy or staff reference], [any previous names or addresses].
Please send the information to me by [email to (address) / post].
I look forward to your reply within one month.
[Your name] [Date]
What happens next
- They may ask for ID if they are not sure who you are. They should only ask for what is reasonable.
- They may ask you to clarify what you want. The clock stops while they wait for your answer.
- They have one month to reply, from the day they receive your request or any ID they asked for. Use our deadline calculator to work out the date. They can extend by two more months if the request is complex, but must tell you within the first month.
- Some information may be removed, for example other people's names or information about a neighbour. They should tell you if they have withheld anything.
If they do not reply, or you are unhappy
- Write to them again, quoting the date of your request, and ask when you will get a reply.
- Make a complaint to the housing association. Organisations must have a process for handling data protection complaints and acknowledge them within 30 days.
- If that does not resolve it, complain to the Information Commissioner's Office. It is free.
If you live in England and want information about how your homes and services are run, rather than about you, look at STAIRs, which gives tenants of housing associations a separate right from 1 April 2027.
Questions
Do I have to use my landlord's form?
No. A form can make things quicker, but your landlord cannot insist on it. A letter, email or even a phone call is a valid request.
Will it cost me anything?
Usually not. An organisation can only charge if a request is manifestly unfounded or excessive, or for extra copies of information it has already given you.
Can a solicitor or family member ask for me?
Yes. They will need your written permission, or a legal document such as a power of attorney, and your landlord will check it.
Can I ask for information about my neighbour?
No. A subject access request only gives you information about you. Information about other people will usually be removed.
Sources
- ICO: Make a subject access request
- ICO: Time limits for responding to data protection rights requests
- ICO: Make a complaint
- UK GDPR, Article 15
This summarises the law and regulator guidance as at 16 October 2026. Take legal advice on a specific request. Spotted something out of date? Tell us and we will fix it.