Data Security

Robust data security protects both compliance and confidence as well as reputational and financial damage

Information Security Matters

Heat network metering data isn’t just numbers - it’s personal data under GDPR, even when anonymised with unique identifiers. That means it must be protected with the same rigour as names and addresses.

Data protection by design and default – privacy must be built in from the start, not bolted on later.

End-to-end security - the entire lifecycle, from collection to storage to reporting, must be safeguarded.

Encryption is essential – unencrypted systems are not secure and risk breaching ICO guidance.

Bigger impact than energy – while electricity and gas smart metering already use encryption, a breach on a heat network could be even more damaging due to the granularity of household data.

Why this matters:

Heat network metering data is highly granular - revealing patterns of occupancy and usage. A breach could expose more than financial information; it could compromise resident safety and trust. Robust data security protects both compliance and confidence as well as reputational and financial damage.

Data Security Checklist for Property Managers

When reviewing your heat network metering and billing provider, ask these key questions:

Data handling & compliance

Is resident metering data treated as personal data under GDPR?
Do you have a Data Protection Impact Assessment (DPIA) for the heat network system?
Is there a clear data retention policy (how long data is stored, when it’s deleted)?
Ideally partner with a third party with Cyber Essential Plus certification

Encryption & protection

Is data encrypted in transit (e.g. SSL/TLS) and at rest (e.g. AES-256)?
Are encryption keys securely managed and rotated regularly?
How is data segregated between different developments or clients?

Access & control

Who can access resident data, and how is access controlled?
Is multi-factor authentication (MFA) required for staff or contractors?
Are there clear audit trails showing who accessed or altered data?

Monitoring & auditing

Are systems regularly tested or security-audited by third parties?
How often are internal security reviews carried out?
Is there a defined incident response plan for data breaches?

Resident communications

How are residents informed about how their data is used and stored?
Can residents request access to their data, and how quickly is this fulfilled?
Are residents reassured about privacy - e.g. unique identifiers instead of names in datasets?