Subject Access Request to British Gas

British Gas is not one controller, and which company holds your records depends on what it did for you. British Gas Trading Limited is the controller for home energy supply, for the data collected from a smart meter, for the Energy Company Obligation scheme and feed-in tariffs, and for the body-worn cameras its field agents use. British Gas Services Limited is the controller for HomeCare and On-Demand and for home insurance. British Gas New Heating Limited is the controller for central heating installations and the warranty. The page that lists all of these notices gives one contact for them — Centrica's data protection officer, at the address above — so a single request reaches the right company, but saying which service you mean saves a round trip. British Gas publishes an unusually specific line about call recordings: it says they are currently kept from November 2022, unless it has a reason to retain them for longer. That is a fixed floor with a date on it rather than a rolling window, so a call from before then is unlikely to have survived and a later one probably has. Some British Gas field agents wear body-worn cameras that record audio as well as video. British Gas describes them as visible and non-concealed, and names British Gas Trading Limited as the controller for the footage, under a privacy notice separate from the one covering your energy account. Smart meter data also has its own notice. British Gas Trading Limited is the controller for the personal data it collects from your meter, and that is where the consumption readings sit rather than in the account paperwork. Exercising a right and complaining go to the same place. British Gas says that to exercise any of your rights, or if you have questions about them, you should use the contact details in its "Getting in touch" section — which are the postal address and email above.

Made under UK GDPR Article 15

Energy and water suppliers hold account and billing history, meter readings and smart meter consumption data, contact and complaint notes, call recordings, and records of any debt recovery or vulnerability flags applied to the account.

Requests usually follow a billing dispute, a back bill or debt collection activity, and the meter and billing history is normally the point of them. Where the argument is about energy, Ofgem's back billing rules say you do not have to pay for energy used more than 12 months ago if you had not had an accurate bill for it before, had not been told what you owed through a statement of account, or your direct debit had been set too low to cover it. That makes the dates on which the supplier actually billed you, and what those bills said, the facts the dispute turns on — which is what a request gets you. The protection is lost if you acted unreasonably, for example by blocking access to the meter, ignoring requests for payment or stealing energy.

Where an account has been passed to a debt collection agency, that agency is usually a separate data controller and needs its own request.

• Billing and payment history
• Meter readings and smart meter consumption data
• Contact notes and complaint records
• Debt recovery correspondence and internal notes
• Vulnerability or priority services register entries

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.