Subject Access Request to giffgaff

Email or post are the routes to use. giffgaff's privacy policy names both for exercising your data rights, and neither needs a giffgaff account. Its other two online routes do not work for that purpose: the "Ask a giffgaff Agent" option and giffgaff's support form both redirect to a member login, and the button on giffgaff's own subject access page labelled "Submit a SAR request" — under a heading calling it the quickest and easiest route — links back to the page you are already on. If the online route defeats you, you can write the request yourself and send it to the address above; a written request is valid however it arrives. giffgaff publishes its data protection officer at two addresses: dpo@giffgaff.co.uk on its privacy policy and on its ICO register entry, and dpo@giffgaff.com on one of its help articles. The .co.uk one is above. The Reading address in giffgaff's regulatory footer, 500 Brook Drive, is its registered office and the building it shares with O2 — giffgaff does not ask anyone to send a data request there. Before you file, note that giffgaff's own advice is that 12 months of call and text records are faster to get by asking an agent, and that account details can be changed in your dashboard. Both of those are behind the member login, so they are open to the account holder and to nobody else. A request reaches things the dashboard does not show — contact and complaint notes, your giffgaff Community posts and messages, credit and fraud-check records, and the file behind an account someone says they did not open. What giffgaff says it will send is narrower than what it holds. Its subject access page says records go back 12 months only, cover outgoing calls and texts, and exclude incoming records and the content of any message — while its privacy policy says it holds the numbers, dates, durations and costs of communications made and received by you. That is a limit on what giffgaff will disclose rather than a statement that the data does not exist, and it is worth naming the incoming records in your request. giffgaff also says it replies within 30 days and may charge an admin fee in rare cases; in law a subject access request is free unless it is manifestly unfounded or excessive, and the reply is due within one calendar month. Ask early. giffgaff says raw network data about calls is kept for up to 12 months, that account information including your profile, contact details and payment history may be kept for up to 7 years, and that information used to provide your service is held for as long as you are a member plus 12 months after you leave. The two figures overlap and giffgaff does not reconcile them, so a former member should assume about a year. giffgaff publishes no retention period for call recordings at all. giffgaff runs on O2's mobile network and Virgin Media's broadband network, and all three are separately registered controllers — an O2 or Virgin Media account is a separate request to a different company. giffgaff also sits in a different complaints scheme from both of them: if a service complaint is unresolved after six weeks or you reach deadlock, giffgaff's adjudicator is the Communications Ombudsman, not CISAS. For someone who has died, giffgaff publishes no route to their records. Its bereavement team, bereavementteam@giffgaff.com, will close or keep the account and asks for a copy of the death certificate, but says nothing about data. Rights of access end at death, so this is not a subject access request.

Made under UK GDPR Article 15

Telecoms providers hold account and billing records, itemised usage, call recordings and chat transcripts from customer service, contact and complaint notes, and the credit checks run when the contract was opened.

Requests here usually follow a billing dispute, a contract taken out fraudulently in the person's name, or a complaint that went nowhere. Call recordings and chat transcripts are typically the useful part, because they show what was actually promised.

Records of who you called or messaged and when are traffic data, and a provider has to erase or anonymise them once they are no longer needed to carry the communication or to bill you for it. That is why usage records reach back months where account paperwork survives for years, and it is the main reason a request made long after the events comes back with less in it than the person expected.

• Account and billing history
• Call recordings and live chat transcripts
• Customer service contact and complaint notes
• Credit checks run at contract opening
• Records of a contract you say you did not open

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.