Subject Access Request to Asda Stores Limited

Asda's published route for a subject access request is its online Data Subject Rights Request form, which opens without an Asda account. The postal address above reaches Asda's Data Protection Team, but Asda does not name post as a request route, so the form is the faster channel. Ignore the US address, phone number and email printed at the foot of the form — they belong to a fictitious company left in by the form's software supplier, and nothing sent to them reaches Asda. Before you file, check your Asda account. Asda says that if you have one you can see much of your information directly, including previous orders and refunds. That is free and immediate, so a request is worth making for what the account does not show — call recordings, email correspondence, accident packs and CCTV. The form covers Asda in store, Asda.com, Asda Rewards, George, Asda Express, the fuel stations and car parks, the pharmacy and the opticians. Two brands have a different controller: Asda Mobile is provided by Vodafone, with Asda and Vodafone as joint controllers, and Asda Money products are provided by partner firms — Jaja Finance for the credit card, Insurance Factory and LV for insurance and breakdown cover, and Ria for money transfers — who are the controllers for those products. Asda is a joint controller with Ria for a money transfer made in store. CCTV footage is personal data and Asda's form takes a request for it, but the window is short: Asda says CCTV is usually kept for 30 days, and as little as 14 days at some sites. Have the date, the time, the store and a description of what you were wearing ready, because the form asks for all four. CCTV is also the one thing you can ask for where Asda requires photo ID. Asda is trialling live facial recognition in some stores, comparing visitors against a watchlist of people it links to theft, violence or fraud in Asda stores. Asda says the watchlist holds no information from the police or other retailers, that an unmatched image is deleted immediately and cannot be retrieved, and that a person's information is removed 12 months after their last visit to a store using the technology. Asda asks for complaints about how it handles your data to go through the same form. Asda is a private company, so freedom of information does not apply to it — the right of access is what you have instead, although Asda says some specific NHS information held by its pharmacy and optical teams is covered by the freedom of information scheme. Three mailboxes on Asda's site are not for your own request, and writing to them will lose you time: lposa@asda.uk is for police data protection requests, and cctvcontrol@asda.uk and fleetadmin@asda.uk are for insurers and solicitors asking for footage of someone else, which Asda says it may charge an administration fee for.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.