Subject Access Request to Lidl Great Britain Limited

Lidl runs several separate data protection routes, and which one you need depends on what you are asking for. For data Lidl Great Britain Limited holds about you as a shopper, the online route is Lidl's customer service form, but it is not signposted: choose the category "Store & General", then the subject "Data Protection", and a "Request Type" field appears offering "Request for information". The form asks for the date of your store visit and lets you describe the member of staff involved, so it is built around in-store incidents rather than everything Lidl holds about you. Lidl's privacy notice points at this portal for exercising your rights but does not actually link it. Emailing the data protection officer is the simpler route and reaches the same function. Lidl Plus is a different company. Lidl's notice says Lidl Plus "is operated and controlled by Lidl Stiftung & Co KG ... Germany as data controller", so a request about your Lidl Plus account, coupons, Lidl Pay or app data goes to the German parent rather than to Lidl GB — and the customer service form offers no data protection option under its Lidl Plus category at all. Lidl also says a Lidl Plus account inactive for 24 months is scheduled for deletion, so a request about shopping from more than two years ago can come back empty. CCTV is the time-critical part. Lidl says footage "is kept for a period of up to 31 days from the time of recording", and only in the event of an incident, investigation or claim is it kept for up to 3 years. A CCTV image of you is personal data, so ask within the month. Lidl says images from its non-scan checkout cameras "are pixelated and no facial recognition technologies are used", and that footage of suspected criminal activity is stored on a third-party crime reporting platform provided by Auror. Lidl's Data Protection Complaints Form is not a way of making a request. Its own page says it "is reserved solely for Data Protection Complaints", and none of its resolution options is getting a copy of your data. Use it if a request has already been ignored. Job applicants have their own route. Lidl's careers notice gives the Surbiton address for the careers website, and Lidl Stiftung & Co. KG in Germany for the recruitment portal profile — though it names two different recipients for the same request in two different sections, so say clearly what you are asking for. Lidl publishes no response time for an access request; the one calendar month it does publish is its target for answering complaints. It publishes no identity requirement and no position on requests about someone who has died. Its customer privacy notice names Lidl Great Britain Limited as the controller and does not mention Northern Ireland.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.