Transparency data

Memorandum of Understanding: Data sharing for the purposes of debt reduction of Former Tenant Arrears

Published 19 March 2026

Applies to England

This Memorandum of Understanding (MoU) between HM Revenue and Customs (HMRC) and Richmond and Wandsworth Councils was agreed and put in place in 2025.

1. Introduction

This MoU sets out the information sharing arrangement between the aforementioned participants. For the context of this MoU ‘information’ is defined as a collective set of data or facts that when shared between the participants through this MoU will support the participants in delivering the purpose of the data sharing activity described in section 3 below.

Information will only be exchanged where it is lawful to do so. The relevant legal bases are detailed within this agreement. It should be noted that ‘exchange’ covers all transfers of information between the participants, including where 1 participant has direct access to information or systems in the other.

This MoU is not intended to be legally binding. It documents the respective roles, processes, procedures, and agreements reached between HMRC (HMRC) and the participants. This MoU should not be interpreted as removing, or reducing, existing legal obligations or responsibilities of each participant, for example as Controllers under the UK General Data Protection Regulations (UK GDPR).

2. Purpose and benefits of the data sharing agreement

2.1 Purpose

This pilot data share between HMRC and Richmond and Wandsworth Councils was agreed for a period of 12 months (subject to Ministerial Approval).  The MoU was originally signed in September 2024, with the data share anticipated to commence in October 2024, consisting of 2 data shares over the 12-month period.  As Ministerial Approval was not received until 9th January 2025, the 12 months pilot is not due to expire until 8th January 2026.  This MoU has therefore been subject to an annual review and assurance check as per Section 17, in order for the pilot to continue for the agreed 12 months from Ministerial Approval.

Richmond and Wandsworth Borough Councils currently have a combined Councils Housing stock of 17,674 properties (23,269 including garage and store shed tenancies), with a further 5,819 private rented Temporary Accommodation properties.

The Housing Revenue Account is self-funding through the collection of tenants rents and is used for maintenance of existing councils housing stock and the financing of regeneration projects to provide sufficient affordable housing for those in need.

The current (unfiltered) debt values resulting from former tenants with a tenancy debt remaining outstanding currently amounts to £10.5 million across both councils.  Richmond and Wandsworth Borough Councils have a strategic objective to improve their former tenants’ arrears collection rate, so that the outstanding arrears can go back into the Housing Revenue Account to continue to provide sufficient funding for those in need. 

Due to many of the tenancy agreements having already ended through eviction, end of tenancy or absconding, debtors have little incentive to provide the councils with forwarding or alternate contact details, which proves difficult for the councils to trace and engage in the resolution of the outstanding debt.  

Currently, contact at last known address and subsequent tracing services are utilised by the councils to locate and engage with the former tenant debtors, however these forms of contact or tracing are not always successful and do not provide the necessary level of detail to enable the councils to establish contact or consider appropriate debt collection solutions.

The current process for councils where the debtor is located, and engagement is established is to encourage a payment arrangement plan through the following recovery options:

• deductions from wages
• deductions from benefits

In cases where the debtor does not continue to engage or set up or continue the relevant payment arrangement, a legal referral will be made by the councils for recovery action through a County Court Judgement (CCJ), which can be an intrusive and costly action, impacting on future financial capabilities of the debtor.

Where the debtor is untraceable or unresponsive to attempts to engage or agree resolution of the debt, the case will either be written off or passed to legal for further proceedings, incurring further costs.

Access to HMRC contact, employment and income data would enable different lines of contact to be established and segmentation of debt in affordability bands, enabling the councils to consider different contact approaches and support based on intelligent data.

Where affordability of the debt is evident through an individual’s earnings, an informed contact will be made by the councils.  Debtors can then be encouraged to make a payment arrangement to prevent actioning of an Attachment of Earnings (AoE) order (where appropriate information is available regarding employment status and income).

Where affordability of the debt is not evident through earnings, such as low income), councils will offer a supportive approach with applicable signposting for debt advice to help get the debtor out of debt (rather than debt out of the person).

HMRC considers that the disclosure of information to Richmond and Wandsworth Borough Councils is necessary and proportionate to support them in their functions to collect outstanding tenancy debt of former tenants.

2.2 Aims of data share

This pilot aims to:

• responsibly reduce and manage debt owed to Richmond and Wandsworth Councils
• reduce the write-off of debts for non-contact or unenforceable cases
• enable an informed approach with debt segmentation leading to improved and  streamlined practices for Former Tenant Arrears collection
• where appropriate, provide support and signposting to resolve debt status and improve financial resilience
• better public perception of Richmond and Wandsworth Councils meeting their obligation to recover debt owed to the public purse

To date £1.2m of debt has been matched to the £2.7m debt included in the data exchange and 10 deceased debtors have been identified enabling a sensitive route through probate channels. The data has enabled a debt segmentation approach based on affordability and associated letter output is due to commence based on said segmentation with different approaches based on affordability, but both based on support and opportunities to resolve their debt.

There is no specific benefit to HMRC other than assisting Richmond and Wandsworth Councils with this pilot data share to assist with tracing former tenants with outstanding tenancy arrears.

2.3 How will data being shared help achieve those aims?

HMRC is a non-ministerial department established by The Commissioners for Revenue and Customs Act 2005 (CRCA 2005). The Act further sets out the functions of HMRC, which includes promoting compliance, prevention and detecting non-compliance, and pursuing tax evaders.

Through these functions HMRC collects the necessary data that will be shared with Richmond and Wandsworth Councils for them to carry out their strategic objective to improve their former tenants’ arrears debt collection rate.  

Without the relevant HMRC data, the Councils are unable to legally adopt a segmented approach to responsible debt recovery based on the propensity to pay and provide the right level of support to debtors.  Therefore:

• financially vulnerable debtors will not receive the necessary signposting and support to resolve their debts and improve their financial resilience
• support to those who could pay with additional support will be limited
• identification of those that could pay but have not paid will be limited
• the effectiveness of our debt recovery will not improve
• efficiency savings through non-referral to legal or court actions will be lost

2.4 Benefits of the data share

This pilot aims to reduce the use of the more intrusive and costly methods of debt recovery, therefore reducing costs to the public purse and providing the right level of support to debtors.

3. Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessments have been completed by both participants in this agreement. The details of which are found below.

Organisation	DPIA Ref	Date registered	last review
HMRC	13944	04 March 2024	06 August 2025
Richmond and Wandsworth Councils	SSA 50/2024	20 February 2024	19 November 2024

4. Relationships under UK GDPR in relation to any personal data being exchanged under this agreement

4.1 HMRC

HMRC will be disclosing and receiving personal data under this agreement.

Where personal data is being disclosed under this agreement, HMRC’s status will be a controller because HMRC separately determines the purpose and means of the processing of the personal data.

Where personal data is being received under this agreement, HMRC’s status will be a controller because HMRC separately determines the purpose and means of the processing of the personal data after transfer.

4.2 Richmond and Wandsworth Councils

Richmond and Wandsworth Councils will be disclosing and receiving personal data under this agreement.

Where personal data is being received under this agreement, Richmond and Wandsworth’s status will be a controller because they separately determine the purpose and means of the processing of the personal data after transfer.

Where personal data is being disclosed under this agreement, Richmond and Wandsworth’s status will be a controller because they separately determine the purpose and means of the processing of the personal data.

5. Handling of Personal Data and Security

Where participants bear the responsibility of a Data Controller (see Section 6.1 and 6.2), they must ensure that any personal data received pursuant to this MoU is handled and processed in accordance with the current 7 UK GDPR principles.

Additionally as part of the Government, HMRC and participant 2 must process personal data in compliance with the mandatory requirements set out in HM Government Functional Standard GovS 007: Security issued by the Cabinet Office when handling, transferring, storing, accessing or destroying Information assets.

Participants must ensure effective measures are in place to protect personal data in their care and manage potential or actual incidents of loss of the personal data. Such measures will include, but are not limited to:

• personal data should not be transferred or stored on any type of portable device unless absolutely necessary, and if so, it must be encrypted, and password protected to an agreed standard

• participants will take steps to ensure that all staff involved in the data sharing activities are adequately trained and are aware of their responsibilities under the DPA, UK GDPR and this MoU

• access to personal data received by participants pursuant to this MoU must be restricted to personnel on a legitimate need-to-know basis, and with security clearance at the appropriate level, and

• participants will comply with the Government Security Classifications Policy (GSCP) where applicable

6. Duration, Frequency and Volume of the data sharing

Date MOU comes into effect	MOU formal review date	MOU cease date	Frequency and volume of the data being shared
01 October 2025	08 January 2026	08 January 2026	This pilot data share was anticipated to commence in October 2024 consisting of 2 data shares over a 12-month period.  The ministerial approval for this share to commence was not received until 9th January 2025. The 1st share took place in March 2025 with volumes of circa 7,500 individuals.  Volumes were expected to be higher for the 1st tranche of data due to including all current historic debt cases.  The 2nd share is due to take place in October 2025.  This will include any new former tenant arrears cases identified from the last data cut. Volumes are expected to be no more than 6,000 individuals.

7. Legal considerations and basis to share data between the participants

HMRC has specific legislation within the CRCA 2005 which covers the confidentiality of information held by the department, when it is lawful to disclose that information and legal sanctions for wrongful disclosure. For HMRC, disclosure of information is precluded except in certain limited circumstances (broadly, for the purposes of its functions), where there is a legislative gateway or with customer consent. Unlawful disclosure relating to an identifiable person constitutes a criminal offence. The criminal sanction for unlawful disclosure is detailed at section 19 of the CRCA 2005.

Data can only be shared where there is a legal basis for the exchange and for the purposes described in this MoU as specified at Section 10 below. No data should be exchanged without a legal basis and all exchanges must comply with our legal obligations under both the Data Protection Act (DPA) 2018 and Human Rights Act (HRA) 1998.

7.1 Legal basis for HMRC to disclose data

HMRC will disclose data to Richmond and Wandsworth Councils using Section 48 of the Digital Economy Act (DEA) 2017

• Section 48 of the DEA 2017 permits HMRC to disclose information to a specified person listed in Schedule 7 of the DEA for the purpose of taking action in connection with a debt owed to a public authority.
• Richmond and Wandsworth Councils are listed in Schedule 7, Section 48, Paragraph 117 of the DEA as a specified person for the purposes of the debt data sharing provisions.

7.2 Legal basis for Richmond and Wandsworth Councils to disclose data

Richmond and Wandsworth Councils will disclose data to HMRC using Section 48 of the DEA 2017

• For the purposes of the taking of action in connection with debt owed to a public authority or to the Crown, the DEA (2017), part 5, chapter 4, paragraph 48.
• HMRC is listed in Schedule 7, Section 48, Paragraph 8 of the DEA as a specified person.

8. Lawful basis under UK GDPR to process personal data

Personal data can only be processed (transferred, disclosed) where there is a valid lawful basis as set out in Article 6 of UK GDPR – see ICO Guidance

8.1 Lawful basis for HMRC to process (share) personal data

The lawful processing of personal data will be undertaken in line with Article 6:1(e) of the UK GDPR (performance of a task in the public interest or exercise of official authority) and section 8(d) DPA 2018 (function of a government departments).

8.2 Lawful basis for Richmond and Wandsworth Councils to process (share) personal data

The lawful basis for Richmond and Wandsworth Borough Councils for the processing of personal data required by this initiative in under article 6(1) (e) of UK GDPR; ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.’

9. Data to be shared

This pilot data share was approved for 12 months following Ministerial Approval on 09 January 2025.  The pilot data share consists of 2 data shares over the 12-month period.  This 1st tranche of data was shared in March 2025, and the 2nd tranche of data is expected to be shared in October 2025.  The pilot will end on 8th January 2026.

Tranche 1 – This was shared in March 2025 with volumes of circa 7,500 individuals.  Volumes were expected to be higher for the 1st tranche of data due to including all current historic debt cases. 

Tranche 2 – Expected to be shared in October 2025.  This will include any new former tenant arrears cases identified from the last data cut. Volumes are expected to be no more than 6,000 individuals.

Richmond and Wandsworth Councils will share personal details with HMRC such as Name, National Insurance Number (NINO), Date of Birth (DoB), last held address and the tenancy period for individual who have an outstanding tenancy debt. 

The data will be pre-filtered by Richmond and Wandsworth Councils prior to sending to HMRC.  The criteria for the pilot data will be:

• debt between £100 - £500
• debt between £500 - £1500
• debt between £1500 - £5000
• debt above £5000
• absconder
• closed accounts
• left Local Authority (LA) area
• untraceable

The data will exclude debtors who are:

• deceased (on Council Records)
• subject to a current payment arrangement
• subject to a current Attachment of Earnings (AoE)
• subject to a current Attachment of Benefit (AoB)
• subject to current court action for Money Judgement
• debt below £100

The data will be sent from Richmond and Wandsworth Councils via Secure Data Exchange Service (SDES). 

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

HMRC will only return data when there is a confirmed match.

Data sent from HMRC to Richmond and Wandsworth Councils:

• individual Identifier
• current HMRC address
• current HMRC postcode
• deceased flag (Y or N)
• employer name
• employer address
• employer postcode
• employer Pay As You Earn (PAYE) ref
• employment start date
• employment end date
• employment pay frequency
• employment last payment date
• employment pay in period
• pay year to date
• payroll ID

The return data is structured as 1 row per individual, per employment, per tax year. If more than 1 employment is recorded on HMRC records, there will be more than 1 row per that individual. This is to assist the councils with the affordability calculation, taking into consideration individual’s income from all most recent employments.

HMRC employment data returned to Richmond and Wandsworth Councils will be for the most recent Tax year available on delivery.  For the return data for Tranche 1 (returned April 2025) this included earnings from 2024 to 2025 Tax Year (6th April 2024 to 5th April 2025).  For the 2nd Tranche of data (due October 2025) this will include earnings recorded from current 2025 to 2026 Tax Year (from 6th April 2025 to week data is matched).

Employment Payment in Period’ can also include Pension Payments as they are also recorded data.  Such payments are included in the data because it would be useful to see affordability according to these received payments.

HMRC will also check to see if the matched individuals have any HMRC Self-Assessment (SA) records.  If so, HMRC will provide the following:

• date SA record set up
• tax Year of last SA return
• total SA Income

The HMRC SA data will be for the most recent submitted return. For 2024 to 2025, the SA submission deadline does not end until January 2026, therefore if return has not yet been submitted, data from 2023 to 2024 submission will be provided instead.

10. How the data will be shared

The data will be shared from Richmond and Wandsworth Councils to HMRC via SDES and returned from HMRC to Richmond and Wandsworth Councils via SDES.

11. Accuracy of the data being shared

Before sharing data both participants must take all reasonable steps to ensure that the data they share is both accurate and up to date.

The exporting department will ensure that data integrity meets their own department’s standards, unless more rigorous or higher standards are set out and agreed at the requirements stage.

Participants will notify each other of any inaccuracies of the data as they are identified.

12. Retention and destruction of data

12.1 HMRC

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

12.2 Richmond and Wandsworth Councils

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

13. Onward disclosure to third parties

Not applicable in this data exchange.

14. Role of each participant to the MoU

14.1 Role of HMRC

• identify the appropriate data required from HMRC IT systems or records

• provide the data to Richmond and Wandsworth Councils in Microsoft Excel transferred by SDES from and to agreed contact points

• only allow access to that data by the team requiring it

• ensure that staff handle this data in line with the approved secure transfer method agreed by both departments and within HMRC data security instructions

• only store the data for as long as there is a business need to do so

• move, process and destroy data securely, in line with the principles set out in HM Government Functional Standard GovS 007: Security issued by the Cabinet Office, when handling, transferring, storing, accessing or destroying information

• comply with the requirements in the Government Functional Standard GovS 007: Security and, in particular prepare, for and respond to security incidents and to report any data losses, wrongful disclosures or breaches of security relating to information

14.2 Role of Richmond and Wandsworth Councils

• identify the appropriate data required from HMRC

• only use the information for purposes that are in accordance with the legal basis under which it was received

• only hold the data for as long as there is a business need to do so

• ensure that only people who have a genuine business need to see the data will have access to it

• on receipt, store data received securely and in accordance with the prevailing central government standards, for example in secure premises and on secure IT systems

• move, process and destroy data securely, in line with the principles set out in HM Government Functional Standard GovS 007: Security issued by the Cabinet Office, when handling, transferring, storing, accessing or destroying information

• comply with the requirements in the Government Functional Standard GovS 007: Security and in particular prepare for and respond to security incidents and to report any data losses, wrongful disclosures or breaches of security relating to information

• if Richmond and Wandsworth Councils adhere to a different set of security standards they must inform HMRC what these standards are at 16.3 below and comply with any additional security requirements specified by HMRC

• seek permission from HMRC before onward disclosing information to a third party

• seek permission from HMRC if you are considering offshoring any of the personal data shared under this agreement

• mark information assets with the appropriate government security classification and apply the baseline set of personnel, physical and information security controls that offer an appropriate level of protection against a typical threat profile as set out in Government Security Classifications, issued by the Cabinet Office, and as a minimum the top level controls framework provided in the Annexe – Security Controls Framework to the GSC

• send the data in the above specified format via SDES agreed by both departments under the protective marking ‘Official-Sensitive’

15. Monitoring and Reviewing arrangements

This MoU relates to a regular exchange that must be reviewed annually to assess whether the MoU is still accurate and fit for purpose (not applicable in this case as it is a pilot).

Reviews outside of the proposed review period can be called by representatives of any     participant. Any changes needed as a result of that review may be agreed in writing and appended to this document for inclusion at the formal review date.

Technical changes necessary to improve the efficiency of the exchange that do not change the overarching purpose can be made without the requirement to review formerly the MoU during its life cycle but must be incorporated at the formal review stage.

A record of all reviews will be created and retained by each participant.

16. Assurance Arrangements

HMRC has a duty of care to assure any data that is passed on to others. Processes covered by this MoU will be subject to annual reviews, from the date of sign off. HMRC may also choose to introduce ad hoc reviews. Assurance will be provided by the annual completion of a Certificate of Review and Assurance (CoRA). The assurance processes should include checking that any information sharing is achieving its objectives (in line with this MoU) and that the security arrangements are appropriate given the risks.

Richmond and Wandsworth Councils agrees to provide HMRC with a signed CoRA within the time limits specified upon request.

HMRC reserves the right to review the agreed risk management, controls, and governance in respect of this specific agreement.

17. Security Breaches, Security Incidents or loss unauthorised disclosure of data

The designated points of contact  are responsible for notifying the other participant in writing in the event of loss or unauthorised disclosures of information within 24 hours of the identification of the event.

The designated points of contact will discuss and agree the next steps relating to the incident, taking specialist advice where appropriate. Such arrangements will include (but will not be limited to) containment of the incident and mitigation of any ongoing risk, recovery of the information, and notifying the Information Commissioner and the data subjects. The arrangements may vary in each case, depending on the sensitivity of the information and the nature of the loss or unauthorised disclosure.

18. Subject Access Requests

In the event that a Subject Access Request (SAR) is received by any participant they will issue a formal response on the information that they hold following their internal procedures for responding to the request within the statutory timescales. There is no statutory requirement to re-direct SARs or provide details of the other participant in the response. However, each participant will notify the other if a SAR is received in respect of any personal data shared under this agreement.

HMRC Contact

Richmond and Wandsworth Councils Contact

Full details of Data subject’s rights in relation to processing of personal information can be found in each participant’s Privacy Notice – links below. Also, see ICO Guidance

HMRC Privacy Notice

Richmond Councils Privacy Notice

Wandsworth Councils Privacy Notice

ICO Data Sharing Code of Practice – The rights of individuals

19. Freedom of Information Act (FOI) 2000

All participants are subject to the requirements of the Freedom of Information Act (FoIA) 2000 and shall assist and co-operate with each other to enable each organisation to comply with their information disclosure obligations.

In the event of 1 participant receiving an FoI request that involves disclosing information that has been provided by any other participant the organisation in question will notify the other to allow it the opportunity to make representations on the potential impact of disclosure.

HMRC FOI Contact

Richmond Council FOI Contact

Wandsworth Council FOI Contact

20. Issues, disputes, and resolution

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

21. Costs

RIS Government Data Exchange Team will recharge for all cross-government data exchanges where there is no reciprocal benefit to HMRC. Recharges are based on resource costs, including both governance and analytical resource and are in line with HMRC Fees and Charges guidance.

22. Termination

This MoU may be terminated by giving 3 months’ notice by any participant.

All participants to this MoU reserve the right to terminate this MoU with 3 months’ notice in the following circumstances:

• by reason of cost, resources, or other factors beyond the control of the HMRC or participant 2

• if any material change occurs which, in the opinion of HMRC and participant 2 following negotiation significantly impairs the value of the data sharing arrangement in meeting their respective objectives

In the event of a significant security breach or other serious breach of the terms of this MoU by any participant the MoU will be terminated or suspended immediately without notice.

In the event of a failure to cooperate in a review of this MoU or provide assurance the agreement may be terminated or suspended without notice. The DEA Secretariat must be informed.

23. Signatories

This content has been withheld because of exemptions in the Freedom of Information Act 2000.