Subject Access Request to British Airways

The route. British Airways asks you to use its online data subject access request form. It opens without a sign-in, so a closed account or a lost password is not an obstacle. There is no separate British Airways data protection email address — the privacy policy's own "contact our Data Protection Officer" link goes to the same form, and the only email address anywhere on that policy belongs to a different company. A delayed or cancelled flight is a claim, not a subject access request. British Airways handles compensation, expenses, baggage and refunds through its complaints and claims service, and it says on the request form itself that "Submitting a data access request will not speed up customer service issues and may delay resolution." A request will get you the records — your booking, your correspondence, the delay codes British Airways holds about your flight — but it cannot award you anything. If you want both, claim first and request second. A lot of what people ask for is free and immediate. Booking details and travel receipts are in Manage My Booking, or through the proof of travel and baggage receipt form; Avios balances and statements, and changes to your personal details, are in your British Airways Club account; marketing preferences are in the Permissions Centre. British Airways points requesters at all four rather than at the request form. Call recordings may not exist. British Airways says not all calls in its Engagement Centres are recorded, so a request for a copy of a call may come back empty. Give the date, the approximate time and the number you called from. Records go seven years after you stop being a customer. British Airways says it removes or anonymises your information seven years after you stop interacting with it, so a request about a flight from a decade ago may find very little. The Club is a different controller. If your question is about Avios, tier points or your British Airways Club account, Avios Group (AGL) Limited is also a data controller of that information and publishes its own contact, data.protection@avios.com. British Airways Plc and Avios Group (AGL) Limited are separate ICO registrations at the same Harmondsworth address. Note that British Airways renamed the programme: its current policy calls it The British Airways Club and never uses "Executive Club", although the old name survives in the web addresses. CCTV at the airport is not British Airways' to give. Its privacy policy does not mention CCTV at all. At Heathrow the airport's own surveillance notice says Heathrow Airport Ltd is the controller for imagery captured as you pass through the airport, that footage is normally kept for about 31 calendar days, and that it needs at least five working days before that expires to run a useful search. Ask the airport operator, and ask quickly. A name change on a booking is not the right to rectification. British Airways says its data privacy team cannot action name changes and sends you to its booking pages instead. Somebody has died. British Airways' bereavement help is about changing travel plans and says nothing about records. Data protection rights end at death, so this is not a subject access request. Worked for British Airways? Its request form has separate options for a current employee, a former employee and a recruitment applicant, so the same route covers an HR file — though what to expect from a request to an employer is different from what to expect from a booking record.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.