Subject Access Request to Octopus Energy

Octopus Energy takes data protection requests by email, and its privacy policy is specific: rights are exercised "by contacting us", and "the easiest way to do this is by email to dpo@octoenergy.com". That mailbox appears on exactly one page of Octopus's website — the privacy policy — and Octopus never uses the phrase "subject access request" anywhere on its site, so a request will not be recognised by name. Say what you want, give your account number and the address the request is about, and give the dates. There is no form and no portal. One privacy policy covers four companies. It applies to Octopus Energy Group Limited and, among its subsidiaries, Octopus Energy Limited, Octopus Energy Services Limited and Octopus Energy Operations Limited, all at the same address, and Octopus says it has appointed data protection officers responsible for different entities in the group. Your domestic energy contract is with Octopus Energy Limited, company number 09263424 — its terms say so in terms — so that is the company holding a household account, and one email to the group mailbox reaches whichever entity holds the rest. If you were a Bulb customer, Octopus holds the records now. Octopus says "Bulb Energy has found a new home with Octopus Energy" and that it is "taking responsibility for Bulb's customers", and its own comparison page says plainly that "Both Shell Energy and Bulb customers are now Octopus customers". Bulb's own website is gone — bulb.co.uk now serves a domain-parking page — so there is nowhere else to ask. Two things Octopus does publish about what came across: your Bulb energy usage was not migrated into the "explore your data" feature in your Octopus account, but the meter readings you gave Bulb were transferred and your previous usage and charges are on your monthly bills; and every account that joined from Bulb has its information shared with TransUnion, so a credit record built up under Bulb is a separate request to TransUnion. If you were a Shell Energy customer, the same is true, and Octopus is more explicit about what actually moved. It says that as of 28 March 2024 it "has migrated all Shell Energy Retail accounts across to Octopus", that "Shell Energy online account and phone lines will no longer be active", that "your account balance, billing history and direct debit information will be securely moved over", and — the fullest statement it makes about any acquired book — that transferring the Shell customers meant transferring "all your customer information (such as historical bills, energy usage, meter information and tariff)". Shell Energy's own website no longer answers at all. Broadband is the exception: Shell Energy's broadband business was sold to TalkTalk, so a request about broadband is not Octopus's to answer. Neither the Bulb nor the Shell page says one word about data protection, and Octopus's privacy policy never mentions either brand. That is the gap to know about before you write: Octopus's own pages establish that the accounts moved and that the billing history moved, and nothing Octopus publishes says how far back the records go or how long it keeps them. One live difference is worth naming because it shows the two books are still handled separately — Octopus says that if you joined from Bulb or Shell, your meter readers come from Morrison Data Services, while everyone else's come from TMA and Calisen. Smart meter consumption data is the record most billing disputes turn on, and Octopus publishes no window for it, so ask by name and give the dates. Its privacy policy says that on a smart tariff it may need to request half hourly data for the period you were on that tariff, and that if it is no longer your supplier it may make that request under an "other user" licence. Its smart tariff terms say that switching to a smart import tariff means agreeing that it can take half hourly readings, and that where readings are missing it estimates no more than four days in a calendar month — so gaps in what comes back may be estimates rather than meter data. Before you file, check your online account: Octopus also runs a public API whose consumption endpoint returns half hourly readings for your own meters, for any date range, using a key from your account, which is faster than a request and free. Octopus publishes no response time of its own for a data request and no list of identity documents. The only figure in its privacy policy's rights section is that it will acknowledge data protection complaints within 30 days, which is about a complaint rather than about getting your data. The legal position is one month, extendable by two more, with identity checks that must be reasonable and proportionate. Octopus also publishes no retention period for call recordings or account records — it says only that it keeps information for as long as necessary, with one exception, that an application that never came on supply is kept for up to two years. It does record calls: its policy says it logs and records interactions including phone calls, and may take video recordings on a welfare or warrant visit. If you want a call, ask early and give the date and the number you rang from. Our free letter template will draft the request, and our free response checker will tell you what is missing from the reply. Three things a request will not do. It will not get you the records of someone who has died — data protection rights end at death — and Octopus handles a deceased person's account through the free Settld service or by getting in touch with the person's name, address, date of death, final meter readings and the executor's or administrator's details. It will not fix a bill: complaints go to issueresolution@octopus.energy, and Octopus says a complaint open for eight weeks may reach "deadlock", after which its formal deadlock letter can be taken to the Energy Ombudsman. And Octopus publishes no arrangement for someone making a request on your behalf — the only representatives it describes are a friend, relative or carer nominated through the Priority Services Register to manage your account and receive your statements, and adding a named person to the account, which needs their own confirmation by email. A request made through a representative is still your request. If you cannot email, Octopus's general customer line is 0808 164 1088, open 9am to 5pm Monday to Thursday and 9am to 4pm Friday; it is not a data protection line, but Octopus's privacy policy says a request can use any of the ways of contacting it listed on its website.

Made under UK GDPR Article 15

Energy and water suppliers hold account and billing history, meter readings and smart meter consumption data, contact and complaint notes, call recordings, and records of any debt recovery or vulnerability flags applied to the account.

Requests usually follow a billing dispute, a back bill or debt collection activity, and the meter and billing history is normally the point of them. Where the argument is about energy, Ofgem's back billing rules say you do not have to pay for energy used more than 12 months ago if you had not had an accurate bill for it before, had not been told what you owed through a statement of account, or your direct debit had been set too low to cover it. That makes the dates on which the supplier actually billed you, and what those bills said, the facts the dispute turns on — which is what a request gets you. The protection is lost if you acted unreasonably, for example by blocking access to the meter, ignoring requests for payment or stealing energy.

Where an account has been passed to a debt collection agency, that agency is usually a separate data controller and needs its own request.

• Billing and payment history
• Meter readings and smart meter consumption data
• Contact notes and complaint records
• Debt recovery correspondence and internal notes
• Vulnerability or priority services register entries

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.