Answer every subject access request on time, and disclose nothing you shouldn't.
A tenant, a leaseholder or a former member of staff can ask for every piece of personal data you hold about them. You have one calendar month. Requests by Strata AI takes the request from the day it arrives to the day the response goes out, with the deadline, the search, the redaction and the final check in one place.
A request rarely arrives on its own.
In housing, a subject access request is often the first step in something bigger. The records you hold about one household sit in emails, Teams chats, repair logs, call notes and case files, and they mention neighbours, contractors and staff.
- Disrepair claimsSolicitors use a request to gather repair history before or alongside a claim.
- Damp and mouldComplaints about hazards bring requests for every inspection, photo and message.
- Antisocial behaviourCase files are full of other residents' details, which must be weighed before anything is disclosed.
- Complaints and the Housing OmbudsmanResidents escalating a complaint ask for the records behind it.
- Employment disputesFrom 1 October 2026 most employment tribunal claims in England and Wales can be brought within six months, up from three. Leavers have longer to make a request.
- Rent and service charge disputesAccount histories, letters and calls about arrears are all personal data.
From receipt to release, in the order the law expects.
Log and validate
Record the request and the date it arrived. The statutory deadline is set straight away, using the corresponding-date rule and UK bank holidays.
Verify identity
Confirm the requester is who they say they are, or that a representative has authority to act. Where the law allows, the clock waits while you do.
Search your systems
Search Microsoft 365, using Microsoft search or eDiscovery, and your housing management, CRM and finance systems for the requester's personal data.
Find the personal data
Each document is checked for personal data, including information about other people that may need to be withheld.
Redact properly
Redactions remove the underlying content from the file. Nothing is left hidden under a black box for someone to copy out.
Pass the release gate
Before anything goes out, an independent check re-reads every file. If a file fails, the release is refused until it is fixed.
Respond and keep the record
Send the response and keep the case record, so you can show what you did if the requester challenges it.
The statutory clock, worked out for you.
Every case moves through a defined lifecycle of fourteen states, so you can see at a glance which requests are waiting on identity, which are being searched and which are due this week.
Want to check a date now? Use the free SAR deadline calculator.
- Wed 2 DecRequest received by emailLogged
- Thu 3 DecProof of identity requestedAwaiting ID
- Fri 4 DecIdentity confirmed. The month startsVerified
- Mon 7 DecMicrosoft 365 search completeSearched
- Fri 18 DecThird-party details redactedRedacted
- Mon 4 JanResponse due, one calendar month onDue
The records stay with you.
Subject access requests involve the most sensitive records you hold. Requests by Strata AI is built so they never need to leave your control.
Your own Azure
Each customer runs in a dedicated tenancy inside their own Azure subscription.
No migration
Requests connects to the systems you already use through standard exports and APIs. Nothing is moved out of them.
Auditable cases
When the ICO, the Housing Ombudsman or a court asks what you did, you can show them.
Requests searches the places housing associations keep personal data, not just email. It connects to:
- Microsoft 365
- Microsoft Dynamics 365
- NEC Housing
- Civica CX
- MRI Software
- Yardi
- IBS
- SQL databases
Using something else? Tell us when you book a demo and we will add a connector for it.
Common questions
For the detail, read our guide to subject access requests for housing associations.
How long does a housing association have to answer a subject access request?
One calendar month, starting on the day you receive the request. If you need proof of identity or clarification first, the month runs from when you receive it. You can extend by up to two further months if the request is complex or you have several from the same person, but you must tell them within the first month and explain why.
Can we charge a fee for a subject access request?
Not usually. A subject access request is free. You can charge a reasonable fee for the administrative cost only if a request is manifestly unfounded or excessive, or if someone asks for further copies of information you have already provided.
Does a request have to be in writing or use particular words?
No. A request can be made verbally, by email, by letter or on social media, to any member of staff. It does not need to mention data protection or use the words "subject access request". Staff who deal with residents need to recognise one when they see it.
What is Requests by Strata AI?
Requests by Strata AI is case management software for UK information rights requests, including subject access requests, freedom of information requests and erasure requests. It calculates statutory deadlines, verifies identity, searches Microsoft 365, detects personal data, applies true redaction and checks every file at a release gate before anything is disclosed. It is made by WeAreStrata Limited, trading as Strata AI.
See a request go from receipt to release.
Book a half-hour demo with the team behind Requests by Strata AI.