Managing Housing Benefit Claims in Supported Housing | Part E: Tools and Appendices
This appendix provides a template data sharing agreement for the routine sharing of personal data about supported housing tenants between a council’s Housing Benefit team, its other teams and providers. It sits alongside the local protocol in Appendix 12 (clause 12) and puts Chapter 12 (12.6) into practice. It has six parts:
- Part A: the model agreement
- Part B: data specification
- Part C: model privacy information for tenants
- Part D: security, transfer and retention schedule
- Part E: individual rights and breach procedure
- Part F: checklist before signing
Why an agreement. A data sharing agreement is not a legal requirement in itself, but the Information Commissioner’s statutory data sharing code describes it as good practice. It sets out the purpose of the sharing, what happens to the data at each stage, and each party’s role (ICO, Data sharing agreements). The code says an agreement should state who the controllers are, the purpose, the data items, the lawful basis for each party, any special category data, and how individual rights and access requests will be handled.
The law in brief.
| Point | What it means for supported housing | Source |
|---|---|---|
| Data protection principles | Data must be processed lawfully, fairly and transparently, limited to what is necessary, accurate, kept no longer than necessary and kept secure | UK GDPR, Article 5 |
| Lawful basis: councils | Claim information is usually processed for a public task | UK GDPR, Article 6(1)(e) |
| Special category data | Health and support information needs a condition, usually statutory purposes and substantial public interest for councils | UK GDPR, Article 9; Data Protection Act 2018, Schedule 1, para 6 |
| Lawful basis: providers | Providers identify their own basis and condition; they share claim evidence with the tenant’s written authority | Chapter 12, 12.6 |
| Confidentiality of Housing Benefit information | A person employed in social security administration commits an offence if they disclose information about a particular person “without lawful authority”. Lawful authority includes disclosure under an enactment and with the consent of the appropriate person | Social Security Administration Act 1992, section 123, subsections (1) and (9) |
| Anonymised summaries | Disclosing a summary framed so that no individual can be identified is not an offence under section 123 | Section 123(3)(a) |
| Reuse within the council | Housing Benefit information cannot be reused for another council function, such as commissioning, unless the law provides a gateway or the claimant consents. DWP’s former guidance said this applies even where the same officer does both jobs | DWP, Local authority data sharing guide (now withdrawn) |
| Statutory gateway | Councils may use and share Housing Benefit and welfare services information with other qualifying persons for prescribed purposes, and pass it to providers of welfare services, which include accommodation and support for people with particular needs | Welfare Reform Act 2012, section 131 and regulations under it |
| Breaches | A notifiable personal data breach must be reported to the ICO within 72 hours of becoming aware of it | UK GDPR, Article 33 |
SHP’s position. Data protection is not a reason for a provider to refuse a reasonable request, or for a council to demand everything. The agreement should make sharing routine where it is lawful and needed, and stop it where it is not. In supported housing, most of what the council needs about a scheme contains no personal data at all, and should be shared that way.
Using the template. Text in [square brackets] is to be completed or deleted. Each party’s data protection officer should review the agreement before it is signed. This template is a starting point, not legal advice, and councils should check the gateways they rely on with their own legal and information governance teams.
Part A: Model agreement
[Council name] Supported Housing Data Sharing Agreement
Version: [number] | Agreed: [date] | Review date: [date, 12 months later]
1. Parties and their roles
1.1 The parties are [council name], [county council name, two-tier areas only] and the providers listed in the signature schedule.
1.2 Each party is a separate controller of the personal data it holds, before and after sharing. The parties are not joint controllers, and no party processes data on behalf of another under this agreement.
1.3 Each party names a data protection officer or lead contact in clause 19.
2. Purpose
2.1 The purposes of the sharing are to:
- decide and pay Housing Benefit claims from tenants of supported housing correctly and promptly
- avoid repeated requests for information that a party already holds
- make and monitor referrals into supported housing within the agreed referrals framework
- protect tenants, including from the loss of their homes and from harm
- support the council’s supported housing strategy, using information that does not identify individuals
2.2 No party will use shared data for any other purpose, unless the law allows it and the other party is told.
3. Lawful basis and legal powers
3.1 Each party relies on the lawful bases and conditions set out below. Each party is responsible for confirming its own.
| Party | Lawful basis (Article 6) | Special category condition (Article 9) | Legal power or gateway |
|---|---|---|---|
| Housing Benefit team | Public task, 6(1)(e) | Substantial public interest, statutory purposes (DPA 2018, Sch 1, para 6) | Housing Benefit Regulations 2006, including regulation 86; tenant consent for disclosure to the provider (SSAA 1992, s.123(9)) |
| Commissioning, housing options and social care | Public task, 6(1)(e) | [As above, or as identified by the council] | [The relevant statutory functions; WRA 2012, s.131 for Housing Benefit information, where a prescribed purpose applies] |
| Providers | [Legitimate interests, 6(1)(f), or contract, 6(1)(b), or consent, 6(1)(a)] | [Explicit consent, 9(2)(a), or another condition identified by the provider] | Tenant’s written authority (Appendix 12, Part E) |
3.2 Where a party relies on consent, it will use the model in Appendix 12, Part E, explain it in plain language, record it, and stop sharing when it is withdrawn.
4. What will be shared
4.1 The data to be shared, by whom, with whom and how often, is set out in Part B. Nothing outside Part B will be shared routinely.
4.2 Scheme-level information, such as service descriptions, staffing models, leases and rent build-ups, will not include tenants’ personal data.
5. Special category and criminal offence data
5.1 Health, support needs and offending history will be shared only where needed for the purpose, in summary form wherever possible, and only with staff who need it.
6. Transparency
6.1 Each party will tell tenants, in its privacy notice and at sign-up, what is shared, with whom and why. Providers will use the model in Part C.
7. Data minimisation and accuracy
7.1 The parties will share the minimum personal data that answers the question. Providers will send summaries, extracts or redacted documents where full records are not needed (Chapter 12, 12.6).
7.2 Each party will correct inaccurate data and tell the other party of any correction to shared data.
8. Security and transfer
8.1 Data will be transferred and held only by the methods in Part D.
8.2 Access will be limited to named roles that need it, and those staff will have had data protection training.
9. Retention and deletion
9.1 Each party will keep shared data only for the periods in Part D and then delete it securely.
10. Individual rights
10.1 Each party remains responsible for responding to requests made to it, including subject access requests, using the procedure in Part E. The parties will help each other to respond within the legal time limits.
11. Freedom of information
11.1 A council that receives a freedom of information request for information supplied by a provider will consult the provider before disclosure, where practicable, and consider any commercial sensitivity.
12. Personal data breaches
12.1 A party that becomes aware of a breach involving shared data will tell the other party’s contact within [24 hours], using the procedure in Part E. Each controller decides whether it must notify the ICO and affected tenants.
13. Data protection impact assessment
13.1 The council will carry out or review a data protection impact assessment before the sharing starts and when it changes significantly.
14. Sharing for other reasons
14.1 Nothing in this agreement prevents sharing that the law requires or allows for other reasons, including safeguarding, the prevention or detection of crime, or fraud investigation. That sharing is outside this agreement and follows the relevant procedures.
15. Joining and leaving
15.1 A provider joins by signing the schedule. A party may leave by giving [one month’s] written notice. Clauses 9, 10 and 12 continue to apply to data already shared.
15.2 The council may suspend sharing with a party that does not comply with this agreement, after raising the concern and allowing a reasonable time to put it right.
16. Complaints
16.1 Complaints from tenants about the sharing will be dealt with by the party that receives them, with the help of the other party where needed. Tenants can also complain to the ICO.
17. Review
17.1 The parties will review this agreement each year, alongside the local protocol (Appendix 12, Part F).
18. Status
18.1 This agreement records how the parties will meet their obligations. It does not change any party’s legal duties, which continue to apply in full.
19. Contacts and signatures
| Party | Data protection officer or lead | Signature | Date |
|---|---|---|---|
| [Council] | |||
| [County council, two-tier areas] | |||
| [Provider] |
Part B: Data specification
| Flow | From | To | Data items | Purpose | Frequency |
|---|---|---|---|---|---|
| B1 | Provider | Housing Benefit | Tenancy, referral, needs assessment summary, support plan, tenant authority (Appendix 5) | New claim | Each new claim |
| B2 | Provider | Housing Benefit | Summary activity record and plan reviews (Appendix 7) | Evidence that support is delivered | On review or request |
| B3 | Provider | Housing Benefit | Scheme evidence pack (Appendix 4); no tenant personal data | Scheme file | Once, then annual review |
| B4 | Provider | Housing Benefit | Notice that a tenant has moved in or out, with dates | Change of circumstances | Within [x] working days |
| B5 | Housing Benefit | Provider | Copies of decisions and claim status, where the tenant has given authority (Appendix 10) | Help the tenant with the claim; manage the tenancy | Each decision |
| B6 | Housing options | Provider | Referral information needed to assess the tenant | Referral | Each referral |
| B7 | Commissioning | Housing Benefit | Whether support is commissioned, and how it is funded, at scheme level | Avoid repeat requests (DWP guidance, para 160) | Once, then on change |
| B8 | Housing Benefit | Commissioning, strategy and licensing | Number of schemes, units, providers and rents, with no individual identifiable | Supported housing strategy | Annually |
| B9 | Housing Benefit | Commissioning or social care | Personal data about a tenant’s claim | [Only with the tenant’s consent or under a statutory gateway, for a stated purpose] | Case by case |
Part C: Model privacy information for tenants
Providers can adapt this text for their sign-up pack. It should be explained in plain language, and offered in easy read where needed.
“How we share your information for Housing Benefit. To help you claim Housing Benefit, we will share some information about you with [council name]. This includes your tenancy, your rent, the date you moved in, and a summary of your support needs and support plan. We only share what the council needs to decide your claim. With your permission, the council will send us copies of letters about your claim, so that we can help you with them.
We keep your information securely and only for as long as we need it. You can ask to see the information we hold about you, and ask us to correct it. You can withdraw your permission for us to act for you at any time. If you are unhappy with how we use your information, please contact [name], or you can complain to the Information Commissioner’s Office.”
Part D: Security, transfer and retention schedule
| Topic | Arrangement |
|---|---|
| Transfer method | [Secure email (for example, encrypted or via a secure portal), or the council’s evidence upload portal]. No personal data by unencrypted email or post without tracking |
| Storage | Council: benefit system and document management system. Provider: [case management system]. No storage on personal devices |
| Access | Named roles only, listed by each party |
| Redaction | Provider redacts personal data the council does not need before sending |
| Retention: claim evidence | [x years after the claim ends], in line with the council’s retention schedule, including subsidy audit and appeal periods |
| Retention: scheme file | While the scheme operates, then [x years] |
| Retention: decision copies held by provider | While the tenancy lasts and any challenge is possible, then [x years] |
| Deletion | Secure deletion or destruction, recorded |
Part E: Individual rights and breach procedure
| Event | What the receiving party does | Time |
|---|---|---|
| Subject access request | Respond for the data it holds; tell the other party if shared data is involved | One month, extendable where the law allows |
| Request to correct data | Correct and tell the other party if the data was shared | Without undue delay |
| Tenant withdraws authority | Stop sharing under the authority; tell the other party | Within [2] working days |
| Personal data breach | Contain it; tell the other party’s contact; each controller assesses whether to notify the ICO and tenants | Other party: within [24 hours]. ICO, where notifiable: within 72 hours |
| Complaint about sharing | Investigate and respond; involve the other party where needed | In line with each party’s complaints procedure |
Part F: Checklist before signing
| Check | Done |
|---|---|
| The purpose of each data flow is stated precisely | ☐ |
| Each party has identified its own lawful basis and, where needed, its special category condition | ☐ |
| The council has identified the legal gateway or consent for any reuse of Housing Benefit information outside Housing Benefit | ☐ |
| Scheme-level flows contain no tenant personal data | ☐ |
| Flows to the strategy and licensing team are anonymised summaries | ☐ |
| The tenant authority and privacy information are in plain language and easy read is available | ☐ |
| Transfer, storage and access arrangements are agreed | ☐ |
| Retention periods are filled in and match each party’s retention schedule | ☐ |
| A data protection impact assessment has been carried out or reviewed | ☐ |
| Each party’s data protection officer has reviewed the agreement | ☐ |
| The agreement is linked to the local protocol and reviewed with it | ☐ |
Previous: Appendix 12: Model Local Protocol
Next: Appendix 14: Further Reading and supportedhousing.blog Resources
This template is licensed under CC BY 4.0: you can adapt it, with credit to SHP. See Rights and licence. Supported Housing People Ltd, Version 1.0, October 2026.