Question 1

Is supported living subject to the same GDPR rules as care homes?

Accepted Answer

Yes. UK GDPR applies to all personal data processing, regardless of the setting. However, the way you apply it differs because supported living involves a dual role — housing provider and care provider — with different legal bases and different data sharing needs. The principles are the same; the application is more complex.

Question 2

Who has the right to see a supported living resident's support plan?

Accepted Answer

The individual themselves has the right to access their support plan through a subject access request. Support workers involved in their care have access on a need-to-know basis. Family members can access the plan if the individual has consented or has appointed them under a lasting power of attorney for health and welfare. If the individual lacks capacity, decisions about sharing must be made in their best interests under the Mental Capacity Act.

Question 3

How do we manage data when a resident shares accommodation with others?

Accepted Answer

In shared supported living, you must take care that information about one resident is not inappropriately shared with or accessible to another. This means separate files, separate access controls and training for staff on maintaining confidentiality in shared households. Incidents involving one resident should be recorded without including identifiable information about housemates unless it is directly relevant.

Question 4

Do we need separate data processing agreements for our housing and care software?

Accepted Answer

Yes — any software that processes personal data on your behalf needs a data processing agreement. If you use separate systems for housing management and care planning, you need agreements with both providers. If you use a single integrated system, the agreement should cover all processing activities. We can review your current agreements and identify gaps.

Question 5

How do we handle financial data for individuals we support with money management?

Accepted Answer

Financial data — bank details, benefit information, spending records — is personal data under UK GDPR. If you support individuals with managing their finances, you need clear policies on who has access, how it is stored and how long it is retained. If the individual has delegated financial authority to you or a deputy, the legal basis for processing may differ. We help providers build financial data governance that protects both the individual and the organisation.

Question 6

What should we do if a support worker discusses a resident with a family member without consent?

Accepted Answer

This is a potential data breach. You should assess what information was shared, whether it posed a risk to the resident, and whether it meets the threshold for ICO reporting. The support worker should receive additional training. If the resident lacks capacity and the sharing was in their best interests, document the rationale. Having clear protocols for family communication helps prevent these incidents.

Question 7

How do we complete the DSPT for a supported living service?

Accepted Answer

The DSPT requires evidence across ten standards including staff training, breach management, device security and access controls. For supported living, particular attention is needed on mobile device security for support workers, financial data handling and multi-agency data sharing. We guide providers through the process from evidence gathering to submission.

Question 8

Can we share information about a resident with their housing officer?

Accepted Answer

If the housing officer is part of your organisation, sharing is likely covered by your internal data governance. If they are from an external housing provider, you need a lawful basis for sharing and ideally a data sharing agreement. Only information necessary for the housing function should be shared — care details are rarely relevant to housing management unless they affect health and safety or safeguarding.

Question 9

How do we manage consent when a resident has fluctuating capacity?

Accepted Answer

Under the Mental Capacity Act 2005, capacity must be assumed unless there is evidence to the contrary, and it is decision-specific. If a resident's capacity fluctuates, consent for data sharing should be assessed at the time the decision is needed. If they lack capacity at that point, decisions must be made in their best interests and documented. Past wishes, beliefs and values should inform the decision. We help providers build capacity-aware consent processes.

Question 10

What happens to a resident's data when they move to a different service?

Accepted Answer

When a resident moves, their data should be handled according to your retention schedule. Care records may need to be retained for a set period, while tenancy data follows housing retention rules. You should transfer relevant information to the new provider with consent or under a lawful basis, and securely dispose of what you no longer need. We help providers create transition protocols that protect individuals during moves.

Question 11

Do we need a Data Protection Officer for a supported living service?

Accepted Answer

If your core activities involve large-scale processing of special category data — which includes care and health data — a DPO is legally required. Many supported living providers outsource this role rather than appointing internally. MHC Solutions can act as your outsourced DPO, providing independent oversight and expertise.

Question 12

How should we train support workers on data protection?

Accepted Answer

Training should be practical and scenario-based, covering real situations support workers encounter — using mobile devices in people's homes, discussing residents with colleagues and families, handling safeguarding information, and managing financial data. It should be delivered at induction and refreshed regularly, especially given the sector's staff turnover. We deliver training specifically designed for support worker roles.

Data Protection That Supports Independence and Dignity

Compliance for services that bridge housing and care

The compliance complexities of supported living

Dual Data Roles

Person-Centred Data

Consent and Autonomy

Multi-Agency Working

Delegated Authority

Shared Accommodation Data

Financial Data

Staff Training Across Roles

Subject Access Requests

Third-Party Suppliers

Cyber Security

CQC and Housing Regulation

Support for the dual demands of care and housing

Compliance Audits

GDPR Consultancy

Information Governance

DSPT Support

CQC Governance

Staff Training

Cyber Security

Ongoing Compliance Support

Protecting people who are building independent lives

Financial Risk

ICO Enforcement

CQC Inspections

Reputational Damage

Individual Safety

Operational Disruption

Staff Confidence

We understand the supported living model

Healthcare Specialists

Practical Advice

Tailored Support

Long-Term Partnership

UK GDPR Expertise

HIPAA Capability

Responsive Support

Modern Compliance Approach

Frequently asked questions