The rule in one paragraph
The requester is entitled to their own personal data. Where giving it to them would also reveal information about someone else, Schedule 2, Part 3 of the Data Protection Act 2018 says you do not have to disclose the other person's information unless they have consented, or it is reasonable to disclose it without their consent. That is a judgement, made item by item, and you need to be able to show how you made it.
It does not let you withhold the requester's own data. If a neighbour's complaint describes the tenant's behaviour, the description is the tenant's data. You may be able to remove what identifies the neighbour while still giving the tenant what was said about them.
The factors you weigh
The Act lists what to consider when deciding whether disclosure without consent is reasonable:
- the type of information, and how sensitive it is
- any duty of confidentiality owed to the other person
- any steps you have taken to seek their consent
- whether they are capable of giving consent
- whether they have expressly refused it
The ICO adds practical questions. Does the requester already know this information? Would the other person expect it to be shared? Could disclosure put anyone at risk? Asking for consent is not compulsory, and sometimes asking would itself be inappropriate, for example asking an alleged perpetrator whether a victim may see what they said.
How it plays out in housing files
Antisocial behaviour cases
Complainants' names, addresses, diary sheets and witness statements are the classic case for withholding. The requester often knows or suspects who complained, so redacting the name alone may not be enough. Look for details that identify the complainant indirectly: a flat number, a description of a car, the time someone was "looking out of the kitchen window". Where a police investigation is live, also consider the crime and taxation exemption.
Repairs and contractors
Operatives' names on job tickets, inspection notes and photos are information about people acting in a work role. It is usually reasonable to disclose them, and redacting every operative's name makes the repair history harder for the tenant to follow. Make an exception where there is a specific reason, such as a threat made against an operative.
Staff
The same applies to your own staff. A housing officer's name on a letter or case note is generally disclosed. Their personal opinions about colleagues, or details of their own circumstances that happen to appear in the file, are not the requester's data and can be removed.
Joint tenants and household members
A joint tenancy file is about both tenants. When one asks, give them their own data and weigh the other's. Take extra care where there is domestic abuse in the history: an address, a new phone number or a support worker's name could put someone in danger.
Children and safeguarding
Safeguarding notes name children, family members, social workers and other agencies. Children's information needs particular care. Where the other person is a social worker or a health professional acting in that role, the Act treats disclosure of their involvement as reasonable in many cases, but the content of a safeguarding referral may still need to be withheld. Consult the safeguarding lead before release.
CCTV, photos and call recordings
Footage and recordings are personal data too. Blur or mask other people's faces, number plates and voices, or provide stills or a transcript where editing the original is not practical. Record what you did and why.
How to redact so it stays redacted
Most redaction failures are technical, not legal. A black box drawn over text in a PDF, highlighted text in black, or text coloured to match the page can usually be copied out or revealed. To redact properly:
- Use a tool that removes the underlying text and image data, not one that covers it.
- Remove hidden content: metadata, comments, tracked changes, hidden rows and columns, speaker notes and file names that identify people.
- Flatten or convert the final file so redactions cannot be undone.
- Check the final output, not the working copy. Search it for the names you redacted and try copying text from under each redaction.
- Have a second person check a sample on large or sensitive responses.
Keep an unredacted master copy and the redacted version you sent. You will need both if the requester complains.
Record each decision
For every item you withhold or redact, record what it was, whose information it was, the reason, and who decided. A short note is enough: "Neighbour complainant's name and flat number withheld. Requester has made threats to complainants, recorded on ASB case 4471. Decided by J Smith, 12 March." If the ICO, the Housing Ombudsman or a court asks why something was missing, this record is your answer.
Tell the requester, in the covering letter, that some information has been withheld to protect other people. You do not have to describe it in a way that defeats the point.
Questions
Can we redact a whole document because it mentions other people?
Usually not. The test applies to the other person's information, not to the document. Remove what identifies them and give the requester the rest, unless what is left would be meaningless or would still identify them.
Do we have to ask third parties for consent?
No. You can decide it is reasonable to disclose, or reasonable to withhold, without asking. Ask where consent is realistic and safe to seek, and record that you did.
Should we redact staff names?
Generally no, for staff acting in their professional role. Redact where there is a specific risk to the member of staff, and record the reason.
Is it a data breach if a redaction fails?
It can be. Disclosing another person's information by mistake is a personal data breach, and you must assess whether it needs reporting to the ICO within 72 hours of becoming aware of it.
Sources
- Data Protection Act 2018, Schedule 2, Part 3 (protection of the rights of others)
- ICO: What should we do if the request involves information about other individuals?
- ICO: Disclosing documents to the public securely
This summarises the law and regulator guidance as at 16 October 2026. Take legal advice on a specific request. Spotted something out of date? Tell us and we will fix it.