Getting Ready for the Social Tenant Access to Information Requirements (STAIRs)

Martin Brazier
|
Senior Consultant at URM
|
|
PUBLISHED on
25
July
2025

Social tenants of local authorities have access to information about the properties in which they live through the Freedom of Information Act (FOIA), but this is not a right available to social tenants of private registered providers (PRPs).  Tenants of PRPs have the right to make a data subject access request (DSAR) under data protection law, but this will only yield their own personal data.  The intention of the STAIRs, therefore, is to plug that information gap and allow tenants of PRPs to obtain information about the management of their housing.

More information on the background of STAIRs and how they compare to rights in FOIA can be found in our blog on STAIRs: A New Standard For Social Housing Providers.

In short, STAIRs will:

  • Require PRPs to publish certain information proactively via a publication scheme
  • Enable PRP residents and their representatives to request data about the management of their homes
  • Set specific time periods for responses to those requests.

Unlike the FOIA, STAIRs limits the requesters to tenants and their representatives, and the requestable information is limited to information about the management of their housing.

PRPs must have a proactive publication scheme by October 2026 and should be ready to handle information requests from April 2027.

More detail on the requirements is going to emerge over the coming months, such as the publication scheme contents and exemptions that can be applied to information requests.  However, the STAIRs are coming, so PRPs can begin to prepare now to ensure they are compliant when the time comes.

What is likely to be included in a publication scheme?

The regulations limit the scope of information which can be requested by tenants to that relating to the management of their housing.  This would typically include:

  • How the housing stock is managed, including planned maintenance, progress on environmental issues, and proposals to buy, sell or improve housing stock
  • Performance, including the outcomes of inspections, ratings, evaluation and performance reports, tenant satisfaction survey results, performance against complaints, health and safety performance, maintenance work and summaries of the responses to requests for information
  • Housing services, including the description of services and guidance for tenants
  • Finance, including how money is spent, any grants and how the service charge revenue is used
  • Governance of the organisation, such as the organisational structure, management and leadership structure, decision making processes, tenant consultations and meeting agendas, minutes and papers
  • Lists, registers and policies related to the management of social housing.

If your organisation is a PRP, how should you prepare?

  1. Understand the requirements of STAIRs and how it applies to your organisation.
  2. Complete a gap analysis to identify the information you hold that is within scope of the publication scheme and the information you have already published.
    Remember: there will be no requirement to create information to include in the publication scheme or to answer information requests; STAIRs only cover the information already held by your organisation.  
  3. Prepare a publication scheme area on your organisation’s website so that you can begin to add information early and move existing published information into the publication scheme.
  4. Communicate with your tenants to inform them of the new rights, when these rights will become applicable, and the information that can be found on the publication scheme.
  5. Speak to suppliers and contractors, as information they hold on your behalf may be requested by tenants.  As such, it is important that you can provide that information in a timely manner to ensure request deadlines are met, and to provide tenants with help when needed.  You should also add standard clauses to supplier contract templates for future contracts that alert suppliers to your STAIRs obligations and their role in helping to fulfill them.
  6. Set up a process for answering requests for information. This is likely to include:
  • Assessing the resources required and ensuring that your staff are trained.
  • Deciding whether specialist request handling or case management software is needed to help record and manage requests.
  • Creating a request log to record requests, when they were received and how and when they were answered.
  • Devising a simple means for tenants to make requests, such as an online form. (Requesters are not obliged to use any particular means to request information, but any request must be in writing to be valid.)
  • Creating a process to identify tenants or their representatives to ensure the request is valid.
  • Assessing the information requested to determine whether it falls within the scope of STAIRs or another information rights regulation, such as a DSAR under data protection law.
  • Creating a process to contact your suppliers and contractors to obtain information they hold on your organisation’s behalf and to track responses.
  • Creating a process to determine a standard appropriate response, including the assessment of whether the request is valid, and if any exemptions apply.
  • Making a decision on the format for providing information so that it is accessible to all requesters.
  • Devising a standard template for answering requests to ensure that a compliant response is made and includes all relevant information.
  • Creating a process to handle complaints if the requester is not satisfied with a response.

Conclusion

While there is still some time before the STAIRs Standard comes into force, PRPs can realise considerable benefit by taking these initial, early steps towards compliance.  Doing so will allow your organisation to lay the groundwork for a smooth and seamless implementation of the STAIRs’ full requirements when details of these become available, thereby avoiding last-minute pressures and reducing the risk of noncompliance.

How URM Can Help

The introduction of STAIRs is an entirely new development in the regulatory landscape for PRPs; however, with 2 decades’ of experience supporting organisations to meet data protection compliance requirements, including through the introduction of the General Data Protection Regulation (GDPR), URM is ideally positioned to help PRPs comply with the STAIRs Standard once it comes into force.  

Our team can offer a gap analysis service, where we review all your relevant processes to determine what changes need to be made for compliance with the STAIRs requirements and provide you with a prioritised remediation list.  URM can also support your development of new processes and policies, and in providing your staff with awareness training and your data protection champions with more in-depth training on how to deal with STAIRs requests.  If your organisation lacks the necessary resource to appoint a data protection champion, URM can offer a virtual data protection officer (vDPO) service, providing ongoing or ad hoc support with any aspect of STAIRs and GDPR compliance that you require.  

Other Data Protection Services

To evaluate the compliance of your organisation’s processing practices, we can conduct a GDPR gap analysis, where we identify the areas in which you are currently meeting the requirements of the Regulation and any areas of noncompliance for remediation.  URM can also provide DSAR support with our DSAR redaction service, where our experts apply the necessary exemptions and redactions to ensure the request is responded to in full alignment with GDPR requirements.

Martin Brazier
Senior Consultant at URM
Martin is a highly experienced and knowledgeable GRC consultant at URM specialising in data protection. He holds BCS Certificates in Data Protection and Freedom of Information and achieved Certified Information Privacy Professional (Europe) (CIPP/E). He also holds BCS Certificates in Information Security Management Principles, Business Continuity Management and Information Risk Management.
Read more

Does your organisation fully comply with the General Data Protection Regulation (GDPR)?

If uncertain, URM is able to conduct a high-level GDPR gap analysis which will assist you understand your current levels of compliance and identify gaps and vulnerabilities.
Thumbnail of the Blog Illustration
Data Protection
Published on
25/7/2022
Data Transfer Risk Assessment

We are focussing on transfer risk assessments (TRAs), commencing with the background that led to their introduction and then addressing the five questions.

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
22/7/2022
Supply Chain Compliance with the GDPR

This blog focuses on an aspect of the GDPR which can be particularly challenging for a number of organisations.

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
5/6/2024
Data Protection Considerations for Data Analytics

URM’s blog explores the data protection considerations for data analytics tools, and how to reap their many benefits while still maintaining GDPR compliance.

Read more
URM’s consultant has successfully guided us through our recent ISO 9001 CAV with zero NCs or OFIs.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.