Subject Access Request to O2

O2 is Telefónica UK Limited, and Virgin Media O2 is the name of a joint venture rather than of a single company. O2's own request page says "O2 and Virgin Media are each still separate Data Controllers", and the ICO register agrees: Telefonica UK Limited (Z5664801) and Virgin Media Limited (Z9713406) hold separate registrations, while VMED O2 UK Limited, the joint venture that owns both, holds none. So a request about a Virgin Media broadband, TV or landline account goes to Virgin Media, not here. giffgaff is a third company in the same group with a registration of its own again, so a giffgaff request is not an O2 request either. Two things O2's request page tells Pay As You Go customers are out of date, and both sit inside a section that stays collapsed until you open it. It asks you to send "your completed form, the fee and proof of identity and ownership", and it says O2 will respond "within 40 calendar days of verifying your details". A fee and a forty-day deadline were the position under the Data Protection Act 1998, which was replaced in 2018, and O2's own form asks for no fee and names no amount. A subject access request is free unless it is manifestly unfounded or excessive, and the reply is due within one calendar month. The top of the same page says 30 calendar days and mentions a fee only for an excessive request. Send no money. The postal address on the page and the postal address on the form the page offers you are not the same, and the form's is the older of the two. Use the Manchester address above. O2's downloadable request form, version 2.0 and dated April 2019 in its filename, prints "Subject Access - O2 Partnership, Chester Road, Preston Brook, Runcorn, WA7 3QA" instead. The form is optional and O2 says it only speeds things up, so a plain email works and you can generate the wording free rather than start from scratch. What the form is good for is its list of what to ask for: outgoing calls and texts, account notes including web chats and correspondence, account details, and copies of call recordings with O2 customer services, with large text, audio and Braille formats available on request. Ask early, and ask about the right side of the call. O2 says it can give you the date, time and dialled number of calls and texts you sent in the last 12 months, but that it is "not able to give you the dates, times or numbers that have called you". Incoming numbers are released only on a valid court order or a lawful request from an enforcement or regulatory body, and court orders and solicitors' disclosure requests go to a separate team at O2CourtLiaison@virginmediao2.co.uk rather than to the Subject Access Team. On recordings of calls you made to O2, its two documents disagree, and the gap matters if you are deciding how long you can wait. The live page says O2 cannot guarantee that every call is recorded but that "any we do record can be provided in audio or transcript format". The 2019 form says recordings "are kept for 6 months" and that "Only audio recordings will be provided". Plan around six months, and ask for a transcript by all means but expect audio. O2 says it cannot give you the content of text messages or personal phone calls, voicemail messages, anything stored on the handset itself, or a signed copy of your phone contract. Contract terms are in O2's published terms and conditions rather than in a copy of the document you signed. Some of what people ask for is free and immediate without a request at all. O2 points customers to My O2 for account details, billing information and marketing preferences, so if recent bills are what you are after that is faster than a subject access request. On how far back to ask: O2's privacy policy says that after you leave it will generally keep information for at least one year and up to seven, depending on the type of information and why it is held, and that credit reference and fraud prevention agencies it has shared with may keep information for up to six years. O2 runs credit and fraud checks and names TransUnion, Equifax, Experian and Cifas as the agencies it shares with. If your request is about a contract you say you never opened, the record that decides the outcome may sit with Cifas rather than with O2, and a Cifas request is free and separate. Only access requests go to the Subject Access Team. Correcting, deleting, moving or objecting to the use of your data is a different route at datarightsteam@o2.com, or by post to Telefónica UK Limited, Correspondence Department, PO BOX 694, Winchester, SO23 5AP. O2's general data protection office is DPO@o2.com. Complaining about how O2 handled your data is a third route again, through the data protection option on O2's complaints form, and O2 says in terms that it has "a separate process for handling your other individual rights such as accessing your personal information". If a reply arrives and it looks thin, check what it should have contained before you accept it. A complaint about how the request itself was handled goes to the Information Commissioner's Office. A complaint about billing or service is a different scheme: O2 belongs to CISAS, which you can use free after six weeks or a deadlock letter, and it is worth knowing that giffgaff, in the same corporate group, belongs to the other Ofcom-approved scheme instead. O2 publishes no route to the records of someone who has died. Its Bereavement and Critical Illness team on 0800 090 1820 closes or transfers an account, and that page says nothing at all about records or personal data. It does carry one warning worth acting on before you contact them: contacts, text messages and voicemails on the old SIM are lost once the account is closed.

Made under UK GDPR Article 15

Telecoms providers hold account and billing records, itemised usage, call recordings and chat transcripts from customer service, contact and complaint notes, and the credit checks run when the contract was opened.

Requests here usually follow a billing dispute, a contract taken out fraudulently in the person's name, or a complaint that went nowhere. Call recordings and chat transcripts are typically the useful part, because they show what was actually promised.

Records of who you called or messaged and when are traffic data, and a provider has to erase or anonymise them once they are no longer needed to carry the communication or to bill you for it. That is why usage records reach back months where account paperwork survives for years, and it is the main reason a request made long after the events comes back with less in it than the person expected.

• Account and billing history
• Call recordings and live chat transcripts
• Customer service contact and complaint notes
• Credit checks run at contract opening
• Records of a contract you say you did not open

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.