Subject Access Request to SSE

SSE sold its domestic energy supply business to OVO Energy in January 2020, and SSE's own privacy notice tells former household customers to go there: it says that if you are a domestic energy customer with a data protection enquiry, you should contact OVO Energy directly. So a request for household billing, account or meter history goes to OVO rather than to the address above. OVO asks for access requests through an online form linked from OVO Energy's privacy policy, and gives dataprotection@ovoenergy.com for everything else. SSE does not say what, if anything, it kept. The redirection to OVO is all its notice offers — there is no statement about whether SSE still holds pre-2020 household account records and no retention period attached to them. OVO's privacy policy does not mention SSE at all, so neither company confirms in writing where the old records went. SSE's networks business is still SSE's, and it is a different set of companies with its own route. Scottish and Southern Electricity Networks is the trading name of Scottish Hydro Electric Power Distribution plc, the controller if you live in northern Scotland, and Southern Electric Power Distribution plc, the controller if you live in central southern England. They hold power cut, connection, wayleave and Priority Services register records, and SSEN says it takes half-hourly consumption data from smart meters installed in customers' homes for network purposes — so meter data can sit with the network operator as well as with your supplier. Requests go to distributiondataprotection@sse.com, or to the Distribution Data Protection Team, 2nd Floor, SSEN, Inveralmond House, 200 Dunkeld Road, Perth PH1 3AQ, or through the request form on SSEN Distribution's privacy notice. The high voltage transmission network in northern Scotland is a third company, Scottish Hydro Electric Transmission plc, at TransmissionDataProtection@sse.com. SSE Airtricity, which supplies energy in Northern Ireland and the Republic of Ireland, is still part of the SSE group and keeps its own notice and its own route: irelanddataprotection@sse.com, or Data Protection Specialist, SSE Airtricity, 25 Great Victoria Street, Belfast BT2 7AQ for Northern Ireland. It routes complaints by country — data subjects in the UK to the Information Commissioner's Office, data subjects in the Republic of Ireland to the Data Protection Commissioner. Job applicants and staff have a fourth route. SSE's applicant privacy notice gives HRGDPR@sse.com, the HR Data Protection Specialist, HR Service Centre, Inveralmond House, 200 Dunkeld Road, Perth PH1 3AQ, and 0345 072 1942, which it offers as one of the ways of contacting SSE about your rights. That line is the HR Service Centre and covers recruitment records, so it is not a general way in for a customer request. No SSE company publishes a response time of its own, and only SSE Airtricity says it may ask you to confirm your identity before it replies. SSE's own notice carries no date or version, while the notices for its networks, Irish and applicant businesses are all dated.

Made under UK GDPR Article 15

Energy and water suppliers hold account and billing history, meter readings and smart meter consumption data, contact and complaint notes, call recordings, and records of any debt recovery or vulnerability flags applied to the account.

Requests usually follow a billing dispute, a back bill or debt collection activity, and the meter and billing history is normally the point of them. Where the argument is about energy, Ofgem's back billing rules say you do not have to pay for energy used more than 12 months ago if you had not had an accurate bill for it before, had not been told what you owed through a statement of account, or your direct debit had been set too low to cover it. That makes the dates on which the supplier actually billed you, and what those bills said, the facts the dispute turns on — which is what a request gets you. The protection is lost if you acted unreasonably, for example by blocking access to the meter, ignoring requests for payment or stealing energy.

Where an account has been passed to a debt collection agency, that agency is usually a separate data controller and needs its own request.

• Billing and payment history
• Meter readings and smart meter consumption data
• Contact notes and complaint records
• Debt recovery correspondence and internal notes
• Vulnerability or priority services register entries

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.