Subject Access Request to Sainsbury's Supermarkets Ltd

Sainsbury's answers subject access requests for its supermarkets, Argos and Habitat under one group privacy policy, and the same email covers all three — Argos's own privacy policy link redirects to it. Nectar is a separate company: Nectar 360 Limited says in its own policy that it is the data controller for the Nectar programme, but it publishes the same request email and the same Manchester address, and Sainsbury's own FAQ answers "How do I get personal data that Nectar hold about me?" with that address. Name Nectar in your request so it reaches the right records. Before you ask: your Nectar account on the website or app already shows your Points statement and your programme account transaction history, free and immediately. A subject access request gets you everything Sainsbury's holds about you, which is more, but if the shopping history is what you came for the app has it already. Nectar also warns that an account with no Points earned or redeemed for 12 months may be suspended or closed, and that the data is kept only a further 12 months after that — so a request about a long-dormant card can come back empty. Sainsbury's Bank is not this route. Sainsbury's says credit card, savings and personal loan accounts have transferred to NatWest, so those records are now NatWest's to answer for. What remains on the Sainsbury's side is Sainsbury's Financial Services Ltd, which asks you to use its own online request form or to email SB_Data_Requests@sainsburys.co.uk — not the address on this page. Sainsbury's Energy is not a Sainsbury's company at all: it is a trading name used under licence by E.ON Next Energy Limited. A CCTV image of you is personal data and store footage goes to the same address, but Sainsbury's keeps it for up to 31 days and then deletes it, except where an accident, incident, criminal activity or breach of its policies was recorded, which it says may be kept longer. Ask quickly. Sainsbury's also uses facial recognition in some stores, supplied by Facewatch — and says Facewatch, not Sainsbury's, is the controller responsible for that processing, so a request about a facial recognition match has to go to Facewatch rather than to Sainsbury's. The Sainsbury's Careline, 0800 63 62 62, is published for correcting data that is wrong or out of date and for changing marketing choices. It is not a route for asking for a copy of your data — use the email or the postal address above. Sainsbury's publishes no response time and no fee for a subject access request.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.