Subject Access Request to Sky

Sky asks you to use its online customer information request form and calls it the quickest and easiest way. The form sits behind a Sky iD sign-in — an unauthenticated visitor is sent to Sky's login page instead — which is a problem if you have closed your account, never had one, or cannot get into it. In the same section Sky says you can make a request about any of your rights at any time and by any method, so the form is the route it prefers rather than a condition of asking. If you cannot reach it, a letter you write yourself is enough. The postal address above is the only one Sky publishes for data matters, and it carries two caveats. It appears under the heading "Complaints and contacting Sky", offered for making a complaint or contacting Sky about its privacy notice or how it uses your information. And it is addressed to Sky Subscriber Services, a different company in the group from Sky UK Limited, which is the one Sky names as the primary data controller for its UK products and services. Sky's own notice spells that company name two ways and does not explain the difference to the reader. Sky says it has one month to respond, counted from when it receives the request and can identify who has made it, and that it aims to provide the information within one calendar month once it has confirmed your identity. Anything that helps it identify you starts that clock sooner rather than later. On how far back the records go, Sky says they are retained securely for up to seven years after an account is cancelled, and are then either securely deleted or anonymised. It also says some categories go sooner where they are no longer needed for the purpose they were collected for, and gives calls recorded with human agents as its example: those are kept for 24 months. If the point of your request is what you were told on a call, that is the clock that decides whether it still exists. Sky says it runs one of two searches every time you buy from it, and which one it runs decides what other lenders see. A hard search is a credit, fraud and identity check, run for any credit agreement sale such as a Sky Glass TV paid in instalments; Sky says it shows on your credit file and that other lenders may take it into account. A soft search is a fraud and identity check, run for SIM-only sales and for anything bought outright, and Sky says it is visible only to you and the agency that ran it and does not affect your credit score. Sky names Equifax and Experian as its chosen credit reference agencies, and says it takes automated decisions on whether to grant a credit agreement using data from you and from those agencies. If a check went against you, Sky says it will not tell you why. You can talk to it about the decision, but it says it cannot give the exact reason and recommends getting your credit report from Equifax or Experian instead. A request to Sky reaches what Sky holds, which is the searches it ran and the information it sent, while the reason for the decision sits with the credit reference agency. Sky also says that once you sign a credit agreement it shares your information every month with credit reference agencies and with fraud prevention agencies including Cifas, and that where an account was cancelled over a debt the Cifas marker stays on your record until the balance is cleared. This is the route for Sky's residential customers. Sky says the process is slightly different for Sky business customers and for NOW and Sky WiFi, which publish their own privacy notices, and that for other Sky companies and businesses you should refer to theirs.

Made under UK GDPR Article 15

Telecoms providers hold account and billing records, itemised usage, call recordings and chat transcripts from customer service, contact and complaint notes, and the credit checks run when the contract was opened.

Requests here usually follow a billing dispute, a contract taken out fraudulently in the person's name, or a complaint that went nowhere. Call recordings and chat transcripts are typically the useful part, because they show what was actually promised.

Records of who you called or messaged and when are traffic data, and a provider has to erase or anonymise them once they are no longer needed to carry the communication or to bill you for it. That is why usage records reach back months where account paperwork survives for years, and it is the main reason a request made long after the events comes back with less in it than the person expected.

• Account and billing history
• Call recordings and live chat transcripts
• Customer service contact and complaint notes
• Credit checks run at contract opening
• Records of a contract you say you did not open

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.