Tenant subject access requests
The file is about your tenant. The people in it aren't.
A tenant has the right to everything you hold on them, within a month. Most of it sits beside things that belong to other people: a neighbour's statement in an ASB case, an operative's name on a repairs ticket, a colleague's note on a complaint, a child's name in a safeguarding record. Your job is to hand over the first and protect the second, under a clock, and be able to show how you did it.
Why these are hard in housing
The request usually arrives mid-dispute. A complaint has stalled, a disrepair claim is being built, a possession case is coming. The response pack may end up in front of the Ombudsman, a judge or the ICO, so every redaction has to be defensible and every omission explained.
The records are scattered. Housing management system, repairs contractor portal, case management for ASB and complaints, SharePoint, years of email, Teams chats, call recordings. A reasonable and proportionate search still has to reach all of them.
The third-party problem is dense. Social housing records name more people per page than almost any other sector's. Operatives, neighbours, witnesses, support workers, family members, children. Each has a right to privacy that sits against the requester's right of access.
What the law now expects
One calendar month from receipt, extendable by two months for complex or numerous requests, with the reason recorded. The Data (Use and Access) Act 2025 confirms you need only make a reasonable and proportionate search, and lets you pause the clock while you seek clarification. Neither gives you a general right to narrow the request or an automatic three months. The ICO expects you to document why any extension or limit was applied.
How we handle it
Receive and verify
The request lands on the register with the clock running from receipt. Identity, authority (for solicitors and representatives) and scope are recorded on the case.
Search
The system searches your housing management system, HR and payroll system, and your Microsoft 365 estate by name, address, tenancy reference and the aliases you add. It records what was searched and what was found, so the search itself is evidenced.
Review
Every document is shown with the requester's data marked and everyone else's flagged by type: staff, contractor, neighbour, third party, child. Your officer decides to include, redact or exclude, one item at a time. Decisions carry a reason.
Redact
Redactions are burned into the output, never layered on top. The system re-reads every outgoing file independently and blocks release if anything slipped through.
Respond
Response pack, covering letter and an evidence pack: what was searched, what was found, what was withheld and why, and who decided. The DPO signs off before anything leaves.
When the request comes from a solicitor
Disrepair firms use subject access requests as pre-action disclosure, often from a template, often in volume. The register shows you the pattern. Authority is checked on each case. The same search discipline and evidence pack apply, so your response stands up when the claim is issued.
What you get
A complete answer inside the month, on records you can show you searched, with redactions you can defend, and a trail that survives the officer who handled it going on leave or leaving.