Thursday 8 September
10:00 — 10:30
Past Event

Understanding GDPR: When can you contact your residents

Following conversations with our Centre partners, and the issues raised in our cost of living event in July by community investment colleagues concerning GDPR and how some of them were facing barriers to communicating with their residents because of perceived GDPR issues. Furthermore, it’s an issue that has come up in many of the conversations we’ve had with colleagues across the UK over the last six months, and one that is causing concerns with them as they look to promote their services to residents.

Therefore, we asked Charlotte Clayson, Partner at Trowers & Hamlins, and a specialist in data protection issues to provide her opinion about when you can contact your residents.

The session included Charlotte’s presentation on GDPR and when you can contact residents and a Q&A session. 

Speaker: Charlotte Clayson, Trowers & Hamlins

Trowers & Hamlins – The Data Protection and Digital Information Bill

This insight on Data Protection and Digital Information Bill covers important topics such as “What is Personal Data?”, “Legitimate interests” and “Re-using personal data”, you can read the full insight article and Charlotte’s contact details here.


Charlotte’s presentation

You can download Charlotte’s presentation here, please feel free to pass this on to your colleagues.

Watch Charlotte Clayson's presentation

Understanding GDPR: When can you contact your residents

Charlotte Clayson, partner at Trower’s & Hamlins and a specialist in data protection issues, shares her GDPR knowledge with us and colleagues from across the social housing sector. 

Q&A session

We had a number of questions arising out of the session, many of which were very similar in theme. We have grouped the responses below by topic.

These answers do not constitute formal legal advice given that we do not have the specific background or context to these scenarios, each of which would require careful consideration given the nuances of the legislation. However, we hope that this is a useful guide when considering where you go next.

There are also potential changes on the horizon with the UK GDPR and Data Protection Act 2018, and also with PECR*. The new Data Protection and Digital Information Bill is making its way through parliament, and once in force will amend the current data protection legislation. A summary of key changes can be found here The Data Protection and Digital Information Bill: what’s in store? -Trowers & Hamlins If you would like to be on our mailing list for webinars and literature on the upcoming changes, please contact Charlotte:


* Privacy and Electronic Communications Regulations

Q. How to get consent from people who haven’t already opted in?
Q. How long does consent last?
Q. Can you use Opt Out rather than Opt In?
Q. In the event of texting resident for rent arrears such as reminder, do we need their consent to text them?

A. On the topic of consent, the first thing to remember is that unless you are sending unsolicited, direct, marketing material by text or email, you are not always required to obtain consent. There are a number of other legal bases which may apply to your communications and allow you to contact residents. Service texts to residents, for example about rent arrears, are unlikely to be classed as marketing communications that require consent. You may be able to rely on another legal basis under the GDPR**. However, if you ever receive objections from people who do not wish to be texted or emailed about certain topics, you should always respect this.

If people have not already consented to receiving marketing material by text or email, you cannot send them a text or email to ask them to ‘opt in’. That in itself is likely to be classed as marketing and will fall foul of the rules. You can try to obtain consent for these types of communications by post, in person, or by phone.

There is no set time period in which consent will remain valid, and it will need to be considered in context. Think about how and why you obtained consent and specifically what you obtained consent for and consider whether it is still applicable to what you are now trying to do. The length of time since you obtained consent will also be applicable.

Remember that consent must be:

  • freely given
  • specific
  • informed
  • unambiguous
  • given by clear affirmative action (i.e. opt in, not opt out)

Consent should be capable of being withdrawn at any time.


** This note uses ‘GDPR’ to refer to the UK GDPR and the Data Protection Act 2018

Q. If decided it is not classed as marketing would contacting residents be exempt from GDPR?

A. If what you are doing is not classed as marketing, then you will be exempt from PECR, which would usually require you to obtain consent to email / text individuals with marketing material. However, if you are contacting residents using their contact details, then you are using their personal data so the usual GDPR rules will apply.

Q. How to comply and what is the balancing test?

A. The legitimate interest condition may be available as a lawful basis for processing personal data, but you must balance your interests against those of the individual and consider what they would reasonably expect you to do with their information.

There is a 3-part test:

  • identify the legitimate interest;
  • show that the processing is necessary to achieve it; and
  • balance it against the individual’s interests, rights and freedoms.

More information can be found here Legitimate interests | ICO.

Q. Do customer feedback solicitations and satisfaction surveys sit under “legitimate interest”?
If we advertise a prize draw as an incentive to complete survey/feedback, where would that sit? It’s promoted on our website and social media but could also be potentially promoted when talking to a customer or email?
Where do we stand if using an external company for customer feedback?
I wondered what the guidelines are around contractors contacting tenants (by phone, letter and email) to arrange access for surveys for works – what info can we pass on and what consents need to be in place for the methods of communication?

We discussed on the session that genuine customer feedback is not classed as marketing material and not caught by PECR. It will be subject to the GDPR only. That means that you do not necessarily need to obtain consent to enable you to contact residents in this way – legitimate interests may be an alternative legal basis.

We also discussed that promoting a prize draw by email would likely fall under the guise of ‘marketing’ and fall under the more stringent PECR regulations. Remember, to fall under the PECR regulations, it must be unsolicited, electronic marketing that is directed at particular individuals.

If you are using third parties to seek customer feedback, you must ensure that as well as a legal basis for undertaking the customer feedback, you also have a legal basis under the GDPR to pass the contact details onto third parties. In particular you should consider whether you are being open, fair and transparent in passing the contact details on, for example by looking at what you have said in privacy notices and any data sharing arrangements in place.

As with customer feedback surveys, when using 3rd party contractors you must ensure that you have a legal basis under the GDPR to pass the contact details onto those third parties. In particular you should consider whether you are being open, fair and transparent in passing the contact details on, for example by looking at what you have said in privacy notices and any data sharing arrangements in place.


Q. If we haven’t looked at personal details and I do a leaflet drop to properties in a street I know has our Housing Association properties- Is this ok to do if residents have said “no” to being contacted about the subject on the leaflet?
Q. Sending out a twice-yearly residents’ newsletter and annual report is that marketing?
Q. In addition, if newsletters are addressed generically e.g. “Dear customer” but are posted out with name & address on envelope…
Q. Where does promoting a community event by a mailshot rather than a leaflet drop? So addressed only to our customers?
Q. Trafford Housing Trust sends booklets to its customers reporting rent & service charges, we have advert pages at the back of the booklet to fill blank pages, we currently use this to advertise in house services to customers, e.g. is that legally ok ?

A. When communicating with residents by post or flyers, you are not likely to need to comply with the stringent PECR rules around consent. That includes when you are sending marketing material by post (which may include resident newsletters by mailshot): PECR applies only to electronic marketing communications that are unsolicited and directed to an individual.

However, if you are using personal data to determine who to direct the material to, you will need to comply with the GDPR. If you were undertaking a blanket or indiscriminate leaflet drop of properties in your area, that would be unlikely to engage the GDPR. However, you cannot avoid compliance with the GDPR simply by removing the resident’s name or address from the material if you have used their name and address ‘ behind the scenes’ to determine where to post it.

An individual can withdraw their consent to any direct marketing at any time. They can also object to the way you are dealing with their data which you must always consider properly and carefully in line with the GDPR.

Q. White paper – asks us to keep customers updated on our services… so how do we balance this with legal requirement. When/if this becomes law?
Q. Is that the case under the white paper / consumer directives though? As it’s a requirement to engage.

Whilst The Charter for Social Housing Residents Social Housing White Paper sets out a requirement to engage with residents and communities, that does not mean that, on its own, it will supersede the current legislation around marketing. In the event that what you are promoting is classed as direct, unsolicited electronic marketing and subject to PECR (and the rules around consent) you should comply with those regulations. Paragraph 89 of the White Paper talks about tailoring engagement appropriately, which would intimate that you also take on board any consents / objections around how people would like to be contacted.

Engagement can take many forms, but the crucial factor is that it is tailored appropriately. There will be tenants who want to proactively engage with the policies of their landlord, and others who simply want to know that their landlord is thinking of them in the way it implements change and is keeping them informed. We expect all landlords to tailor their engagement in the future.


We had a number of questions around specific circumstances where you may wish to contact residents, and whether these would require consent. We answered similar questions in the ‘Examples’ section of the session. Unfortunately we cannot answer all of these individually, but we hope the guide below will assist. This is somewhat of a grey area and, as discussed on the session, you may want to consider the risk profile of what you are seeking to do and take specific legal advice, and / or advice from your internal data protection teams.

You will need consent to send marketing or promotional material by email or text. ‘Marketing’ has a broad definition and some of the things you may be trying to do may be caught. We talked in particular about the risks with promoting community events given the guidance from the ICO which talks about promoting the aims and ideals of an organisation.

Where you are signposting individuals to external services which could assist them, for example with debt management advice, this may not be caught by the PECR rules. As the ICO guidance suggests, the key thing to remember is whether the message is advertising or promoting something – often this comes down to the tone of the communication. Remember the PECR rules around consent only apply to direct marketing by email and text. You do not need express consent to market by live phone call, face to face, or by post.

The cost of living crisis: connected perspectives across social housing

Housing associations across the UK are working hard to support their residents through the cost of living crisis, while continuing to look for bigger, bolder and more collaborative solutions.


HACT, alongside Tpas and Echelon, recently brought together housing professionals from across departments, specialisms, and geographies to discuss what effective cross-organisation and cross-sector action will look like.


Resources from the event coming soon

How can we help

Data in social housing

Whether it is figuring out where exactly in your data journey you are and what comes next, to implementation and data masterclasses, we're here to support you.

The Centre for Excellence in Community Investment

We have 10 geographic networks and 4 thematic networks which meet regular to explore a wide number of topics with each network meeting open to anyone in the sector who thinks they would benefit from being involved.

What's the next step in your data journey?

Not sure? Get in touch with our Digital Lead, Michael McLaughlin

Get in touch