Telecoms provider
Subject Access Request to BT
What BT holds about you, where to send the request, and what to expect back.
GetMySAR is an independent service and is not affiliated with, endorsed by, or acting on behalf of BT. The contact details below are published so you can make a request yourself free of charge.
Where to send your request
Verified 9 August 2026- Postal address
- Data Privacy Team Pp Floor 16 1 Braham Street London E1 8EE
- Their own SAR form
- Open BT’s request form
- ICO registration
- Z5164594
- ID they ask for
- BT does not publish a list of identity documents for this route. Its online form asks whether you are a current customer, a former customer, someone who has never been a customer, or making the request for someone else; then which brand it is about — BT Mobile, BT Broadband, EE Mobile, EE Broadband or PlusNet; then which product; then what kind of request. On the "I want a copy of my data" path it asks for a date range and your first name, last name, email address, mobile number, account number, address and postcode, and a free-text description of what you want; a landline number is optional. You can attach supporting documents smaller than 4 MB, and the form carries a reCAPTCHA. If you are asking on behalf of someone else, BT says you must provide written evidence of your authority and upload it with the form.
Source: BT published information. Organisations change these details — tell us if this is out of date.
One form covers BT, EE and Plusnet, and BT's own documents disagree on retention
Which BT company holds your data. BT's consumer privacy policy is a joint notice covering two separate controllers: "Where we use the words 'We' or 'Our' we mean either British Telecommunications plc or EE Limited – both part of the BT Group." The one responsible for you "will be the company that is named in any terms and conditions or messages sent to you", and in some circumstances the two "are jointly responsible". The ICO register lists them separately — British Telecommunications Limited holds Z5164594 and EE holds Z7510687 — and Plusnet plc is a third, Z9901036. BT's request form asks which brand you mean and offers all five, so one form covers all three companies. Business customers have a different notice and a different form. Check whether you need a request at all. For bills BT says: "If you want a copy of your billing information, you can instantly obtain this free of charge when you log in to your MyBT account. Alternatively, please call 0800 800 150 and we'll send it to you." Mobile billing can be had "by calling 150 from your mobile". Both are free and immediate. A subject access request is for everything that is not in there. The retention windows are the reason to ask early, and BT prints them inside the form rather than on the privacy policy. Call recordings: "Call recordings are kept for 1 year and then are automatically deleted." Chat: "Chat transcripts are only kept for 12 months." Itemised call records: "Itemised call records are kept for two (2) years", and they do not include incoming calls. Bills: "we keep bills for a period of 6 years." BT's two documents disagree. The privacy policy's retention table puts "Customer service records, including calls to our call centres and online chats" at "Up to 6 years from the date of the interaction"; the form says one year for calls and 12 months for chats. Plan around the shorter figure — it is the more specific of the two and it is the one printed at the point of asking. Free-to-call numbers will not appear. BT says itemised records "don't include records of any free numbers like '0800' or '999' calls", because Ofcom's General Conditions prohibit itemising calls that are free to the customer. How long BT has: "It will normally take us up to one month to complete your request, but it could take longer (up to a further two months) if it's a complicated request or you send us a lot of requests at once." Asking for someone else: "If you are making a request on behalf of someone else, you must provide written evidence of this authority." For someone who has died, BT refuses outright — "If the request relates to a deceased person, please note we will not be able to provide this information as part of an individual right request." No email route. BT's consumer privacy policy publishes no data protection email address at all; every route on it is the online form. cpo@bt.com appears on the ICO register and on BT's visitor privacy notice, but BT does not ask consumers to use it, so this page does not print it under "Where to send your request". A subject access request does not have to be made on an organisation's own form, and our free letter template will produce one — but note that BT publishes the Data Privacy Team address for comments and questions about its privacy notice rather than as a request route, so the form is what BT is set up to receive. A service complaint is a different thing. Ofcom's approved dispute schemes put BT with the Communications Ombudsman, not with CISAS. A complaint about how BT handled your request goes to the ICO instead. A contract opened in your name. If that is why you are asking, a Cifas marker may be the record that decides the outcome, and that is a separate free request to a separate organisation.
Making a request to a telecoms provider
Made under UK GDPR Article 15
Telecoms providers hold account and billing records, itemised usage, call recordings and chat transcripts from customer service, contact and complaint notes, and the credit checks run when the contract was opened.
Requests here usually follow a billing dispute, a contract taken out fraudulently in the person's name, or a complaint that went nowhere. Call recordings and chat transcripts are typically the useful part, because they show what was actually promised.
Records of who you called or messaged and when are traffic data, and a provider has to erase or anonymise them once they are no longer needed to carry the communication or to bill you for it. That is why usage records reach back months where account paperwork survives for years, and it is the main reason a request made long after the events comes back with less in it than the person expected.
What people commonly ask for
- Account and billing history
- Call recordings and live chat transcripts
- Customer service contact and complaint notes
- Credit checks run at contract opening
- Records of a contract you say you did not open
Watch out for
- Ask early. A provider has to erase or anonymise usage data once it no longer needs it, so the gap between the events you care about and the request often decides what comes back.
- Give the phone numbers, the dates and the approximate times you are asking about. A request that does not narrow the period tends to come back as billing data without the calls you actually wanted.
- Another person's number is their personal data as well as part of your record, so records of incoming calls and messages are commonly withheld or redacted, and some providers will release them only under a court order or witness summons.
- Providers carry your calls and messages but do not normally keep what was said in them, so a subject access request will not produce the content of a call or a text. Recordings of calls you made to the provider's own customer services are a different thing and can be asked for.
- A subject access request gets you the records; it does not get a bill or a service problem put right. Complain to the provider first — after six weeks, or once it issues a deadlock letter, one of the two Ofcom-approved ADR schemes will consider a service complaint free of charge, and which one depends on your provider. A complaint about how the provider handled your data goes to the Information Commissioner's Office instead.
Your rights, whoever you are asking
Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.
Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.
Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.
How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.
If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.
Send it to BT
You can do this yourself for free using the details above. If you would rather not handle the wording, the submission and the chasing, GetMySAR prepares, sends and follows up your request for a fixed £20 fee.
This page is general information about your right of access under UK data protection law. It is not legal advice. If your situation is complex or contested, consider speaking to a solicitor or contacting the Information Commissioner’s Office.