Right now, across the UK social housing sector, a troubling pattern is emerging; the over-collection and under-use of Equality, Diversity, and Inclusion (EDI) data. Tenants are being asked to hand over intimate details – ethnicity, religion, sexual orientation, gender identity, even full-blown medical diagnoses – without any real explanation of why, other than a vague “to improve our services.”
But that’s not inclusion; that’s intrusion.
Because when there’s no clear purpose and plan (which, by default, means there’s no lawful basis under the (UK)GDPR) and no meaningful insights or action following the data grab, EDI data collection stops being about inclusion, and becomes invasive, causing real harm, not to mention the waste of resources.
The Purpose Paradox of EDI in Social Housing
Social landlords are under pressure to demonstrate a better understanding of their residents’ needs, thanks to the new consumer regulatory standards. But in the rush to respond, many are mistaking more data for better understanding.
Enter the ‘Purpose Paradox’, the phenomenon that occurs when your how doesn’t match your why:
You begin with a well-meaning goal – to improve equality, diversity and inclusion. But the way you go about it (like mass data collection without a plan) actively undermines that goal.
It’s not just counterproductive. It’s unlawful. It’s unfair. And it’s wasteful.
Let’s be clear: The law doesn’t require you to do what you think it does
I’ve heard several housing providers all across England claim they have to collect all the protected characteristics of all their residents because “the Regulator says so.” But that’s not accurate.
The Regulator of Social Housing wants you to understand the diverse needs of your tenants, yes. But there’s no requirement – legal or regulatory – to collect such sensitive data from everyone, all the time, just in case it might be useful someday.
In fact, doing so without a lawful basis, and without a clear purpose, is a breach of the (UK)GDPR.
No amount of good intentions changes that.
Housing providers are referring to the new consumer standard the Transparency, Influence and Accountability Standard.
“2.1 Diverse needs
2.1.1 Registered providers must use relevant information and data to:
a) understand the diverse needs of tenants, including those arising from protected characteristics, language barriers, and additional support needs; and
b) assess whether their housing and landlord services deliver fair and equitable outcomes for tenants.”
However, this is being misread, in my experience. I reached out to the Regulator of Social Housing to raise my concerns and they replied:
“landlords should ensure they are compliant with relevant legislation (including GDPR)”.
“The Consumer Standards Code of Practice…emphasises that in collecting personal data about tenants, landlords should ensure they are compliant with relevant legislation (including GDPR) and the Information Commissioner’s Office guidance, as well as respect tenant privacy.”
“That has always been the responsibility of each individual landlord and finding lawful and appropriate ways in which to comply with our standards is what we expect when delivering regulatory outcomes, which includes being clear on their purpose for collecting data.”
The biggest blocker I see, to understanding the difference between collecting data for statistical monitoring purposes and collecting it for tailoring services, is that these two very different purposes – that require different types of information – are lumped into one “EDI data” pot. Being clear about the different purposes is the first step to reducing the risks associated with “EDI data” over-collection.
What lawful, meaningful EDI monitoring actually looks like
You can collect and use EDI data lawfully for the purposes of monitoring and improving equality of opportunity and treatment, or for the purposes of tailoring services to individuals’ needs, but only if you do it properly. Let’s look at EDI monitoring first.
Doing it lawfully and fairly means following the 5 P’s:
Purpose – You must have a clear reason for collecting the data: to maintain or improve equality of treatment or opportunity for your staff, customers, or residents. It must not be about making decisions about individuals – that’s a different purpose, that we look at in the next paragraph.
Policy – You need a written policy explaining what you collect, why, how it’s used, how long it’s kept, and how people can opt out or object to its use.
Principles – The (UK)GDPR and Data Protection Act still apply. That means data minimisation, accuracy, storage limitation, security, transparency, and fairness, all need to be baked in from the start.
Processors – If you’re using any third parties to process the data, you must carry out proper due diligence and have lawful agreements, including data processing clauses, in place. You’re still responsible for what they do with the data on your instructions.
Privacy – Keep it anonymous where possible. At the very least, use pseudonyms or separate storage. That data shouldn’t be sitting next to someone’s name in your HR system or Housing Management System.
And once you’ve got your data, what next?
That’s where the 4 I’s come in:
Identify the gaps – Are your services, workforce, or satisfaction levels (as just some examples) representative? Where are you falling short?
Investigate the causes – Don’t guess. Find out whether the gap is about unequal opportunity, unequal treatment, or both.
Ideas for improvement – Work with experts, communities, and colleagues to design changes that genuinely improve access, acceptance, or experience.
Implement and embed – Choose the right actions, put them in place, and make sure they stick. Real change means sustained effort, not one-off initiatives.
If you’re not doing all of this, then you’re not monitoring or improving equality and inclusion; you’re just collecting highly sensitive data and creating risk.
Tailoring services based on diverse needs
When it comes to tailoring services to meet individual needs – like providing information in a different format or language, installing adaptations, or simply giving a tenant a bit longer to get to the door – it is lawful to collect personal data that helps you do so. This kind of data use is grounded in your duties under the tenancy agreement and under legal obligations such as equality, housing, and health & safety law.
But here’s the catch: you don’t need to – nor should you – try to collect all the information about all customers’ characteristics all the time and all at once. Timing and relevance are crucial. For example, when a customer reports a repair or a problem with damp and mould, that’s the most appropriate time to check if they have children in the home, if anyone has asthma, or if they need a bit longer to get to the door before the appointment is marked as a missed appointment. All of these things are subject to change – children are born or move into a home, asthma and other conditions can develop at any stage in life, and temporary injuries can impair someone’s ability to answer the door quickly just as much as a long-term condition can.
Also, be aware that the data gathered to meet an individual’s needs can’t simply be repurposed for broader monitoring or analysis. Doing so requires a full review of your purpose, your lawful basis, your privacy notices, and how the data is handled.
It’s also vital to distinguish between tenant needs – which you’re likely legally required to meet – and preferences – which are part of providing good customer service (and you might not even have the ability to meet). Both matter, but they’re not the same, and neither justifies a casual approach to collecting or reusing sensitive information.
The way the questions are phrased needs is another risky area, where unclear wording can cause confusion and result in a lack of actionable insights. For example, asking someone if English is their first language is not the same as asking if they need their letters or emails translated. (Many people have English as a second or even third or fourth language, but don’t need any translation!)
The impact of poor EDI data practices
When tenants are asked deeply personal questions without proper context, it understandably erodes trust. And it’s not just about feeling uncomfortable – we live in a world where people are harassed, attacked, and even killed, because of their skin colour, their beliefs, or who they love.
Responsible landlords, who often claim to put the tenant “at the heart” of everything they do, should challenge themselves; can you honestly say that tenants and prospective tenants are happy, even comfortable, being asked about such private matters when the imbalance of power weighs so heavy? How many people feel pressured to answer the questions just so they aren’t seen as being difficult?
When staff are burdened with extra EDI data collection responsibilities, with no real purpose, they can burn out.
When vast pools of sensitive data sit unused and unprotected, you’re showing poor data governance, and it’s ripe pickings for a cyber-attack.
And when nothing meaningful changes off the back of all this data collection? That’s when your relationships with residents goes from bad to worse.
A better way: Purpose-led EDI strategy and data management
This isn’t about saying no to EDI work. Quite the opposite.
This is about saying yes, to real, measurable, sustainable inclusion that starts with purpose and ends in action that gets you closer to your core purpose.
That’s what the CP Data Protection team and I help organisations do.
We support social landlords and purpose-led organisations to:
Clarify their EDI goals – based on real-world needs and tenant/staff experience
Design lawful, proportionate, and meaningful data strategies – that meet regulatory expectations without breaching trust or privacy.
Build buy-in across the organisation – so EDI work doesn’t sit on the shoulders of a few overstretched champions.
Turn insights into improvements – with actionable plans to address inequality and embed change.
And most importantly? Help organisations reconnect with their core purpose.
Because your job isn’t to collect data for data’s sake.
Your job is to provide safe, secure, affordable homes, and to do that fairly and equitably for everyone.
Let’s make sure your EDI Data strategy supports that.
Ready to stop over-collecting and start improving?
Let’s have a conversation. Whether you need help designing a proportionate EDI data approach, reviewing what you’re already collecting, or mapping out a lawful plan of action, the CP Data Protection team can help you lead with purpose, and act with integrity.
Get in touch to find out more about our consultancy support for EDI, data protection, and KIM (knowledge and information management) in the UK social housing sector: Clare@cpdataprotection.com Or Sue@cpdataprotection.com
Support & resources available for purchase include the CPDP Online EDI Data Toolkit, a bespoke EDI Clarity Session, or the newly launched EDI Data Insight Accelerator for more in-depth support. See the details of our EDI sessions here.
For ongoing support, become a member of the DiSH community for collaboration and continued learning, and your membership fee includes access to a growing library of resources covering EDI Data and everything else related to customer data and colleague data in social housing (as well as regular live sessions, in-depth strategy sessions, news and updates, case studies, a chat forum and more): Data in Social Housing membership
What people say about our EDI Data Strategy sessions:
“The session was really helpful the other day, thank you.”
“Thank you so much, it was very eye opening!”
“Thank you! This was such a useful session. I really enjoyed it, and the time flew by!”
“Great informative session and the templates will be useful, thanks.”
“Really useful and lots to think about and challenge. Thanks Clare.”
“It was a very informative and useful session, thank you very much.”
Client EDI Data Case Studies
Cutting through the noise
Before: The senior leadership team at a housing association had spent months going around in circles about whether to ask EDI questions of residents, and what their lawful basis could be, and how to use the data.
What We Did: In just a couple of hours in an EDI Data Clarity Session, we re-wrote their plan for EDI data collection, including re-drafting the wording on their Customer Preference survey.
After: The new survey questions were clear, useful, and legally sound – enabling them to provide reasonable adjustments that residents are entitled to, without over-promising or being privacy-intrusive.
Result: Improved customer service and stronger trust – a genuine win/win.
Decisions without drama
Before: A DiSH network member joined a new employer who was stuck in repeated, tense conversations about collecting EDI data from all residents (not just the main tenant) for statistical purposes.
What Happened: Using the EDI data materials, she led a calm, unbiased discussion focused on balancing benefits with costs and risks.
After: The team realised the extra data would add little value to their strategy. They reduced the amount of data to be collected.
Result: Saved time, resources, and money, lowered compliance risk and security risk, and better customer reactions to surveys.
From Risky Plans to Purpose-Led Practice
Before: A DPO+ Service client was planning a new EDI Data Survey for residents. The draft included asking about sexuality and religion without a clear purpose or explanation – risking both GDPR breaches and customer trust.
What We Did: Through targeted discussions, we slimmed down the survey, clarified the purpose of each question, and ensured all data collected had a lawful basis and a clear plan for use.
After: The client has cut out unnecessary questions and will now collect only relevant data, knows exactly how it will be used, and will explain this transparently to residents.
Result: Improved customer trust, while reducing costs, as well as reducing compliance risks and security risks.