What does data privacy compliance ask of your technology? 

Data privacy compliance asks your technology to prove what your policies promise. You need to know what you hold and limit who can see it. Delete records on schedule, and put any data sharing in a written agreement. Run a Data Protection Impact Assessment (DPIA) before a new system or portal goes live. 

The Regulator of Social Housing’s Sector Risk Profile 2025 names data protection and cyber security as strategic risks. Your Data Protection Officer (DPO) leads on the legal detail. The ICO’s accountability framework shows you how to check where you stand.

Where do you start with housing data management? 

Start with a data map of every system that holds tenant information. That includes your housing management system, repairs database, email, shared drives, and third-party portals. For each one, record what it holds, who can access it, and how long you keep it. 

Review the map once a year, because new systems and staff changes create gaps. Then name one person who is accountable, whether that’s your DPO or a senior leader. 

How do you protect tenant data in Microsoft 365? 

Protect tenant data in Microsoft 365 by controlling what leaves by email and who can sign in. Tenant data does not stay in your housing system. It spreads into email, Teams, and SharePoint, where one wrong click can send it to the wrong person. What you can use depends on your licences. 

Data loss prevention policies in Microsoft Purview can spot sensitive information in an email. They can then warn the sender or block the message. Sensitivity labels can encrypt a file, so only the right people can open it. 

Microsoft Entra adds multi-factor authentication (MFA) and conditional access, so a stolen password is not enough. Microsoft Intune lets you enforce encryption on field devices and wipe one that goes missing. It also pays to review permissions on shared sites, since old access builds up over time. 

We help housing associations set these tools up around how their teams work.  

Which other controls support tenant data security?

Encrypt tenant data at rest and in transit, and patch known vulnerabilities quickly. The NCSC treats patching as a priority within its Cyber Essentials framework. 

Endpoint detection and response (EDR) with 24/7 monitoring can flag suspicious activity before it becomes a breach. Our managed security services provide that, so you don’t need to build a security operations team. A tested backup matters too, because it lets you restore records after a ransomware attack. Our data backup, recovery and protection services cover this. 

How do you check the security of property management software? 

Ask every supplier the same questions before you commit. Your property management software is likely to hold more tenant data than any other system you run. 

• Does it support role-based access and MFA? 

• Can it log who viewed or changed a tenant record? 

• Can you set retention periods and delete data on schedule? 

• Where is the data hosted, and who can reach it? 

• Will the supplier sign a data processing agreement? 

Test any tenant-facing portal before launch, with data protection in mind. If a supplier can’t answer plainly, treat that as a warning.

What should you do if a tenant data breach happens?

Contain the breach straight away, then assess how serious it is. Tell the ICO within 72 hours of becoming aware if the breach is likely to put people at risk. Record every breach internally, whatever its size, because the patterns show you where to improve. 

Agree roles in advance, so everyone knows who leads, who speaks to tenants, and who reports to the ICO. Then rehearse with a tabletop exercise. Staff training helps too, especially simulated phishing and a culture where people report mistakes without fear. 

How does Phoenix support housing association compliance?

We know the pressures you face. IT teams are stretched and regulation is demanding, yet tenants expect better digital services. We start with your goals and risk profile, and only then do we recommend solutions. 

Our governance, risk and compliance services cover Cyber Essentials and Cyber Essentials Plus certification. Our information security strategy service gives you a clear roadmap. For incidents, our cyber security services include response support from a UK-based team that understands housing.