STAIRs and data protection: What Private Registered Providers need to know

Private Registered Providers (PRPs) of social housing in England are now subject to new information access requirements under the Social Tenant Access to Information Requirements (STAIRs). From 1 October 2026, PRPs must proactively publish specified information about the management of their social housing. Tenants can also request a review where they believe information that should have been published is missing. From 1 April 2027, tenants will also be able to request information directly from their provider. 

STAIRs introduces a new information rights processA series of actions or steps taken in order to achieve a particular end. alongside existing data protection requirements. Providers will need to distinguish between STAIRs requests and Data SubjectAn individual who can be identified or is identifiable from data. Access Requests (DSARs), identify where the two overlap, and make sure personal dataInformation which relates to an identified or identifiable natural person. is handled appropriately when information is published or disclosed.  

Key takeaway: STAIRs introduces new transparency and information access obligations for PRPs of social housing. Providers should prepare by reviewing what information they hold, setting up clear publication and request-handling processes, and making sure staff know when a request falls under STAIRs, data protection lawAny law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction (as amended, consolidated or re-enacted from time to time) that relates to the protection of individuals with regards to the Processing of personal data., or another information rights regime. 

• What are the Social Tenant Access to Information Requirements?
• Who does STAIRs apply to?
• What information must social housing providers publish under STAIRs?
• How will STAIRs work?
• What’s the difference between a STAIRs request and a DSAR?
• How should PRPs prepare for STAIRs?

What are the Social Tenant Access to Information Requirements? 

STAIRs is a new information access framework for social housing tenants of Private Registered Providers (PRPs) in England, with the Housing Ombudsman acting as the complaints body. It was introduced to increase transparency and accountabilityPerhaps the most important GDPR principle, which requires controllers to take responsibility for complying with the GDPR and, document their compliance. in social housing, giving tenants greater access to information about how their homes and housing services are managed.  

The requirements come in two chapters:   

• Chapter one covers publication schemes and applies from 1 October 2026 
• Chapter two covers requests for information and applies from 1 April 2027  

STAIRs doesn’t replace existing information rights. Instead, they introduce an additional route for tenants to access information, alongside existing rights under data protection and other legislation. 

Who does STAIRs apply to? 

STAIRs applies to: 

• Private Registered Providers (PRPs) of social housing in England, including housing associations. A PRP is a social housing landlord registered with the Regulator of Social Housing that isn’t a local authority.
• Social housing tenants of those providers, including licensees and shared owners with less than 100% of the equity. Tenants may also nominate a representative. 

Managing agents and contractors are not directly subject to STAIRs. Where they hold relevant information on a provider’s behalf, the provider must use all reasonable endeavours to obtain it and respond to the tenant’s request. 

Local authority landlords are not covered by STAIRs and are already subject to Freedom of Information (FOI) legislation. 

What information must social housing providers publish under STAIRs?

From 1 October 2026, providers must make information available across seven classes: 

• Governance and decision making
  Senior staff names and roles, organisational structures and governance arrangements, decision-making processes and policies, complaint prioritisation, and information about tenant consultations and meetings.
• Spending
  Information about spending, grants and the use of service charge revenue.
• Housing stock management
  Plans, maintenance work, progress towards net zero and stock transfers.
• Performance
  Inspection outcomes, ratings, performance reviews and evaluation reports, Tenant Satisfaction Measures, media releases, complaint metrics, information request data, health and safety performance and assessments, maintenance work and eviction numbers.
• Housing services
  Descriptions of services, advice and guidance for tenants.
• Lists and registers
  Information held in registers required by law and other lists and registers relating to the management of social housing.
• Social housing management
  Policies and strategies relating to the management of social housing. 

Providers must keep published information under regular review and update it as necessary. However, they are not required to create new records solely to comply with the publication requirements. 

What if the information contains personal data? 

Before publishing information, providers should consider whether the information contains personal data relating to employees, tenants, complainants, or other identifiable individuals, and whether disclosure of that personal data would be lawful. Appropriate redaction, data minimisationThe third GDPR principle, requiring organisations to only collect the personal data that is truly necessary to fulfill each purpose for data processing., and disclosure controls may be required.  

The presence of personal data does not necessarily mean the entire document cannot be published. Providers should consider whether the personal data can be appropriately redacted whilst the remaining information is made available. 

How will STAIRs information requests work?

From 1 April 2027, social housing tenants or their designated representative will be able to request information about the management of their social housing. This could include information about repairs, rent, service charges, anti-social behaviour, complaints handling, and health and safety. 

However, not all information will fall within the scope of STAIRs. For example, information created after a request is received, decisions made by local councils, and information accessible through another statutory route are excluded. 

Requests must be made in writing and applicants must be identifiable. Tenants do not need to specifically refer to STAIRs when making a request, so providers will need to identify requests based on their substance rather than the terminology used. 

Providers have 30 calendar days to respond, although further time is permitted in exceptional circumstances. 

What’s the difference between a STAIRs request and a DSAR?

STAIRs creates an additional route for tenants to access information, but it is distinct from the right of access under data protection law. 

Broadly, a STAIRs request concerns information about the management of social housing, whilst a Data Subject Access RequestA verbal or written request made by a data subject to access their data (in a portable format if requested), be informed about how it is used, to have their data modified if it is incorrect, or to have it deleted. (DSAR) allows an individual to access their own personal data. 

The two regimes can overlap, and a single request may engage both. Where information is accessible under an existing statutory right, including the right of access under the UK General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR), it falls outside the scope of STAIRs. A request may nevertheless contain separate elements that need to be considered under different information rights regimes. For example: 

• “Please provide your policy for allocating repairs by priority.” – Likely to be a STAIRs request. 
• “Please provide the notes your housing officer made about me following my complaint.” – Likely to be a DSAR. 
• “Please provide records showing how the decision about repairs to my property was made.” – Potentially both, depending on what information the records contain. 

Providers should therefore triage requests according to their substance, rather than relying on the terminology used by the person making the request. 

How should PRPs prepare for STAIRs? 

With the publication requirements already in force, PRPs should review their existing information governance processes now to identify where STAIRs requirements can be incorporated and where new processes may be needed. 

Key steps include: 

• Map information and ownership
  Establish what information falls within STAIRs, where it’s held, and who is responsible for maintaining and providing access to it.
• Review publication processes
  Identify what information must be proactively published and put appropriate review, redaction, and disclosure controls in place.
• Create a request triage process
  Make sure staff can distinguish between STAIRs requests, DSARs, and other information requests, as well as recognise where more than one regime may apply. 
• Align existing procedures
  Consider where STAIRs can be incorporated into existing information rights processes and where workflows, responsibilities, or escalation routes can be sensibly shared.
• Train staff
  Make sure customer service, complaints, housing management, and other tenant-facing teams understand how to recognise a STAIRs request and what to do when they receive one.
• Establish governance and oversight
  Define who is responsible for STAIRs compliance, when requests should be escalated, and when input from the DPO or data protection team may be required.  

Don’t wait until tenants can submit direct information requests in April 2027. Begin testing request handling, escalation, redaction, and mixed STAIRs/DSAR workflows now. 

Our specialist team can support social housing providers with the information review and redaction challenges arising from STAIRs, helping ensure disclosures are handled efficiently and in accordance with data protection requirements. Contact us to learn more. 

In case you missed it…

• Using AI for DSAR responses: What every organisation should know
• FOI vs DSAR: What’s the difference?
• Case Study: Ocasa Homes