Policy paper

Housing design quality audit resident survey: privacy notice

Published 17 March 2026

Applies to England

The following is to explain your rights and give you the information you are entitled to under UK data protection legislation.

1. The identity and contact details of the Ministry of Housing, Communities and Local Government (MHCLG) and our Data Protection Officer   

MHCLG is the data controller. The Data Protection Officer can be contacted at dpo@communities.gov.uk

2. What personal data we are collecting and why  

Your personal data is being collected as part of the Housing Design Quality Audit, which includes a survey of residents living in, or close to recently completed housing developments.

Verian sent survey invitations to addresses within selected developments so that residents can choose to take part. Personal data is collected only from individual residents who respond.  If you agree to be recontacted (or enter the optional prize draw), we will use the contact details you provide only for that purpose, and we will contact individuals - not addresses. Recontact will be made to the consenting resident using their personal contact details, not to the address.

This resident survey is part of a wider Housing Design Quality Audit. As part of this audit, trained professionals will also carry out site assessments of housing developments, and publicly available information (such as planning records) will be reviewed. Survey responses will be analysed alongside these findings to understand the design quality of new housing developments. Individuals will not be identified in any published outputs.

We will collect your survey answers and, if you choose to give them, your contact details (e.g. name and email/phone) so we can recontact you about related research. We also record which development your response relates to (for analysis; not to identify you in publications). The survey includes some voluntary questions about demographic characteristics and wellbeing, such as ethnic background. Some of this information is classified as special category personal data under UK data protection law. Participants may choose “prefer not to say” for these questions.

We are collecting this data to understand residents’ experiences of housing design and quality, to inform housing and design policy and guidance, and - if you opt in to recontact - to invite you to possible follow-up research in the future.

Survey invitations were sent to addresses selected at random from a Royal Mail address database; MHCLG did not receive names or contact details unless an individual chose to respond.

3. Lawful basis for processing the data 

MHCLG processes personal data under Article 6(1)(e) of the UK GDPR, as processing is necessary for the performance of a task carried out in the public interest. Where participants agree to be recontacted for future research, this processing is based on consent. Recontact is optional and not required to take part in the main survey. Any future recontact would be solely to invite you to take part in further housing design research and would not involve tracking your individual responses over time.

Where the survey collects special category personal data (such as ethnic background or wellbeing information), this is processed under Article 9(2)(j) of the UK GDPR for research purposes, with appropriate safeguards in place.

4. With whom we will be sharing the data

Verian is contracted by MHCLG to deliver the survey and will process personal data on MHCLG’s behalf. MHCLG will receive survey data for research and analysis purposes. Any published outputs will be anonymised so that individuals cannot be identified. Where participants consent to recontact, contact details will be securely transferred to and held by MHCLG.

Anonymised and aggregated survey findings may also be shared with Homes England; Homes England will not receive identifiable personal data and is not a data controller for this survey.

5. For how long we will keep the personal data, or criteria used to determine the retention period.

Verian (MHCLG’s data processor) will retain personal data securely for the duration of the contract with MHCLG and delete it in line with contractual and data-protection requirements. MHCLG will retain personal data only for as long as necessary to complete the research and quality-assure findings.

Where participants have agreed to be recontacted, MHCLG will retain contact details for up to six years, after which they will be securely deleted. Participants may withdraw consent at any time.

6. Your rights, e.g. access, rectification, erasure 

You have rights over your personal data, including the right to be informed, to access your data, to request correction, to object to certain processing, and to withdraw consent where applicable. You also have the right to complain to the Information Commissioner’s Office (ICO).

To exercise your rights or withdraw recontact consent, contact dpo@communities.gov.uk

7. Sending data overseas

Participants’ personal data will not be transferred outside the EU. All data will be securely stored within the UK or EU by MHCLG and its appointed processors.

8. Automated decision making

Participants’ personal data will not be used for any form of automated decision-making.

9. Storage, security and data management

9.1 Secure Transfer and Storage

All personal data will be securely transferred, stored, and managed in accordance with MHCLG’s Data Processing Agreement with Verian.

9.2 Data Processor Responsibilities

Verian, acting on behalf of MHCLG, is responsible for the secure management of the data. All Verian staff handling personal data are DBS-checked and operate under strict cybersecurity protocols approved by MHCLG’s cybersecurity team.

9.3 Retention and Deletion

MHCLG will retain identifiable personal data only for as long as necessary to complete the research and quality‑assure findings, after which it will be securely deleted. Personal data will be deleted once it is no longer required. Where appropriate, de-identified data (e.g., survey results without personal identifiers) may be retained for longer to support future policy development.

9.4 Legal Compliance

MHCLG will process data only within the limits of UK data protection laws, including the UK GDPR and the Data Protection Act 2018. Regular reviews will be conducted to ensure data is not held longer than necessary. This research is being carried out by Verian and CRESR on behalf of MHCLG, with Verian acting as the data processor for this project.

10. Complaints and more information

When we ask you for information, we will keep to the law, including the UK General Data Protection Regulation and Data Protection Act 2018.

If you are unhappy with the way the Department has acted, you can make a complaint.

If you want to make a request to access your data, or another request in relation to your rights, or if you are not happy with how we are using your personal data, you can contact dpo@communities.gov.uk

If you still have a concern about the way in which MHCLG has handled your personal data you can contact the Information Commissioner’s Office to make a complaint using their website service or by telephoning 0203 123 1113. Further information about your data protection rights can also be found on the Commissioner’s website.