Subject Access Request to OVO Energy

OVO takes subject access requests through an online form, and its privacy policy is specific about which route is for what: the form is for access to your data, a second form is for deleting it, and dataprotection@ovoenergy.com is for all other rights requests. The form link in the policy has been replaced twice and now redirects automatically to the current form; if it stalls, OVO's current subject access form is where it lands. The form works in stages. It first asks who is applying — you, a third party on your behalf, or an OVO employee on your behalf — then the date the request was first made (today's, unless you already asked OVO another way), the name of the person the request is about and the service (electricity, gas, feed-in tariff, Smart Export Guarantee, OVO Home Services, CORGI Home Plan or an energy efficiency scheme), and only then the account number, the full address, the dates the request covers and a description of the data you want. Email and phone number are optional, but give a phone number if the request is about calls, because the form asks for one, and use the date boxes, because it asks for both. It takes attachments, and it asks for no identity document up front — OVO's policy says it might ask you for something to confirm your identity before it replies. OVO's form says it has one calendar month to fulfil a request and may need longer where the request is complex, and that its preferred way of responding is electronically through the OneTrust portal where it holds an email address for you. The privacy policy itself gives no response time for a request — the 30-day figure in it is for acknowledging a complaint to the Data Protection Officer. The legal position is one month, extendable by two more. Before you file, check your online account: OVO's form says key information is now available there without waiting for a subject access request — personal details, financial details, meter details and readings, tariff information and payment and billing information for an energy account, and the policy schedule, renewal information, proof of boiler service and engineer reports for home services. A request is the route for what the account does not show. OVO's policy lists, among the data it holds, conversations with you including phone calls and emails which may be recorded, notes added to your account, complaint and incident details, your credit history and details of any outstanding debt, and any vulnerability or Priority Services information — and a request is the only route to a closed account, or to an account that was never yours to log into. Smart meter readings are the record most disputes turn on, and OVO's policy says what it takes: since 3 November 2022 the default for anyone joining, switching tariff or getting a new smart meter is half-hourly readings for settlement and daily readings for billing, with 7 days from the email (10 days from a letter) to opt out to daily, and monthly is the lowest it is allowed to take. Ask for the half-hourly consumption data by name and give the dates. OVO's form also says it is not required to create data to answer a request, so if half-hourly readings never reached OVO from your meter there is nothing for it to return. OVO's privacy policy covers five companies as one "we" — OVO Energy Ltd, OVO Electricity Limited, OVO Gas Ltd, OVO Solar and Heating Ltd and OVO (S) Energy Solutions Limited — and its form says it covers all of them, so one request reaches whichever holds your records. Two of the five were SSE companies until the day OVO's purchase of SSE's household business completed: Companies House records that OVO Solar and Heating Ltd was Southern Electric Gas Limited until 16 January 2020, and that OVO (S) Energy Solutions Limited was SSE Energy Solutions Limited until the same day. OVO's own policy does not mention SSE, Southern Electric, Scottish Hydro or SWALEC at all, so a former SSE customer will find nothing on OVO's site confirming they are in the right place — but SSE's own privacy notice sends domestic energy customers here, and the request goes through the same form. Since 1 September 2026 OVO Home Services Ltd — boiler and home emergency cover — is no longer an OVO company: the policy says it is now owned by Hometree, renamed HTG Home Services Limited, and is a separate data controller, so those records need their own request. The form has an option for a third party applying on the customer's behalf and asks for the third party's name and contact email; OVO says it cannot accept a request raised on someone's behalf without explicit authority, and may carry out further verification checks or ask for more information. A request made through a representative is still your request. OVO's separate "request for information" form is for the police, government agencies, councils and insurers, and its policy says in terms that personal subject access requests will not be processed through it. A request about someone who has died is not a subject access request. OVO has a bereavement team — 0330 175 9683, bereavement@ovoenergy.com, or the form on its bereavement page — which transfers the account, closes it, or keeps it running in the name of the executors, and sends a final statement within four weeks of closing. Post and email are for other things. The address above is the Data Protection Officer's, which OVO gives for complaints about how your data has been handled and says it will acknowledge within 30 days; dataprotection@ovoenergy.com is the same officer's address and the route OVO gives for rights requests other than access and deletion. A written request is still valid — OVO's rights section says you can use its contact details to ask for a copy of your data, and our free letter template will draft one — but the form is the route OVO designates for access, and the one that asks the questions OVO needs answered. OVO publishes no retention periods: its policy says only that it keeps personal data for no longer than is necessary, and it attaches no window to call recordings, so ask as soon as the calls you care about have happened. A request gets you the records; it does not settle the bill. OVO's form says it cannot help with complaints or account disputes, and its complaints procedure — complaints@ovoenergy.com, or its customer lines, 0330 303 5063 for Pay Monthly and 0330 175 9669 for Pay As You Go — says it aims to resolve a complaint within 8 weeks, after which, or after a deadlock letter, the Energy Ombudsman will take it. If what comes back looks thin, our free response checker will tell you what is missing.

Made under UK GDPR Article 15

Energy and water suppliers hold account and billing history, meter readings and smart meter consumption data, contact and complaint notes, call recordings, and records of any debt recovery or vulnerability flags applied to the account.

Requests usually follow a billing dispute, a back bill or debt collection activity, and the meter and billing history is normally the point of them. Where the argument is about energy, Ofgem's back billing rules say you do not have to pay for energy used more than 12 months ago if you had not had an accurate bill for it before, had not been told what you owed through a statement of account, or your direct debit had been set too low to cover it. That makes the dates on which the supplier actually billed you, and what those bills said, the facts the dispute turns on — which is what a request gets you. The protection is lost if you acted unreasonably, for example by blocking access to the meter, ignoring requests for payment or stealing energy.

Where an account has been passed to a debt collection agency, that agency is usually a separate data controller and needs its own request.

• Billing and payment history
• Meter readings and smart meter consumption data
• Contact notes and complaint records
• Debt recovery correspondence and internal notes
• Vulnerability or priority services register entries

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.