Subject Access Request to EE

EE Limited is the controller for your EE mobile and broadband account, and it holds ICO registration Z7510687. Two EE-branded products are not covered by it. EE's privacy policy says EE Finance "is provided by Glow Financial Services Limited" and that "Glow is a controller of your personal information", and that EE's insurance products are "underwritten by Chubb European Group SE" and that "Chubb is a controller of your data in their own right". Both are separately registered with the ICO - Glow ZA814740, Chubb ZA484290 - so records about a device finance agreement or an insurance claim have to be asked for from them rather than on EE's form. Chubb publishes its own privacy policy, and EE links Glow's notice from its own. That privacy policy covers BT as well as EE: "Where we use the words "We" or "Our" we mean either British Telecommunications plc or EE Limited - both part of the BT Group", and it says the two are jointly responsible in some circumstances. The company responsible for your information "will be the company that is named in any terms and conditions or messages sent to you", so if you have held both BT and EE services, check which name is on the contract before you ask. Plusnet is a third company in the same group with its own registration. EE lists what it will provide: personal account information such as contact details, email addresses, mobile numbers and postal address; notes from the account; "Call recording details for the past 12 months (subject to availability)"; copies of contract and payment correspondence; and call logs for the past 12 months. Its glossary defines call records as "the date, time, length and cost of your communications, device information, the location the call was made to and from, the network used and the type of communication" - so the location data people often ask for separately sits inside that. It also lists what it will not provide: incoming call details, "unless needed by a solicitor with a Court Order or Witness Summons"; the content of SMS, MMS, voice calls or deleted voicemail; call record logs older than six months; and historical itemised billing. The same page promises call logs for the past 12 months in one list and rules out logs older than six months in the other, adding that "in some circumstances, we may be able to provide call logs for the past 12 months". Plan around six months, ask as early as you can, and say which numbers, dates and times you mean. EE's published retention table explains the shape of that. Account details are kept "6 years from the date on which your account is closed", a summary copy of your bills six years from the date of the bill, customer service records including calls to its call centres and online chats up to six years, and details relating to a dispute six years from the date the case was closed. Usage data is not kept anything like as long: "SMS content and data relating to calls" is held 7 days from when the SMS is sent and up to 12 months after the call, and where you have itemised billing EE keeps "a record of your outgoing calls for 2 years from the date of the call". That 7-day figure is how long EE holds the data, not what it will hand over - the request page rules out the content of texts and calls either way. The longest period in that table is not about calls at all. Where you have used EE's reusable verified ID, EE keeps the original identity document and facial recognition data for three years and the details extracted from the document "for up to 10 years", both from the date of the check. For the one-off verified ID check the same two figures are six months and six years. Check whether you need a request at all. EE says that for billing information "the quickest way to access this information is by logging into your EE account or, for your mobile billing information, by calling 150 from your mobile", and that you have to be the account holder to ask that way. If you are on a business account through your employer, EE asks you to go through them: "If you work for one of our corporate customers, ask your employer to request a copy of your personal information on your behalf." The request form is hosted for BT Group on OneTrust rather than on ee.co.uk. It asks whether you are a current customer, a former customer, someone who has never been a customer, or acting for someone else, and then what kind of request you are making - "I want a copy of my data" is the subject access option, and the same form covers corrections, deletion, portability and contacting the data protection officer. You can attach supporting documents under 4 MB, and it carries a reCAPTCHA. If you cannot use it, a request in writing to the Data Privacy Team address above is valid, and our free letter tool will produce one. EE says it will send the response electronically unless you ask for it by post. EE publishes no email address for data protection on either its request page or its privacy policy. The address that appears on the ICO register, cpo@bt.com, is BT Group's privacy office rather than a route EE asks you to use, so this page does not print one. A complaint about EE's service - a bill, a fault, a contract - is a different thing from a complaint about how EE handled your request, and it goes somewhere else. Ofcom's list of approved dispute schemes puts EE with the Communications Ombudsman rather than with CISAS. You can go there free of charge six weeks after you first complained, or once EE issues a deadlock letter, provided it is less than 12 months since that letter. If the account holder has died this is not a subject access request, because data protection rights end at death. EE publishes a bereavement route for closing or transferring the account, but neither that page nor its request page nor its privacy policy says how a relative can obtain the records themselves. A contract opened in your name that you did not open is one of the commonest reasons for a request to a mobile provider. If that is what happened, Cifas may hold a fraud marker about you as well, and that is a separate free request to a separate organisation. When EE's response arrives, check whether it is complete - and if parts are held back, EE warns it "might not be able to provide you with information if it would infringe someone else's rights", which is one of the recognised limits on the right.

Made under UK GDPR Article 15

Telecoms providers hold account and billing records, itemised usage, call recordings and chat transcripts from customer service, contact and complaint notes, and the credit checks run when the contract was opened.

Requests here usually follow a billing dispute, a contract taken out fraudulently in the person's name, or a complaint that went nowhere. Call recordings and chat transcripts are typically the useful part, because they show what was actually promised.

Records of who you called or messaged and when are traffic data, and a provider has to erase or anonymise them once they are no longer needed to carry the communication or to bill you for it. That is why usage records reach back months where account paperwork survives for years, and it is the main reason a request made long after the events comes back with less in it than the person expected.

• Account and billing history
• Call recordings and live chat transcripts
• Customer service contact and complaint notes
• Credit checks run at contract opening
• Records of a contract you say you did not open

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.