Subject Access Request to Transport for London

TfL does not run one subject access route. It publishes a separate request form for each kind of record: Oyster and contactless, road user charging including the Congestion Charge, ULEZ and the Low Emission Zone, London Underground CCTV, body worn cameras, traffic enforcement cameras, bus station CCTV, customer contact centre correspondence and call recordings, taxi and private hire licensing, HR and job applications, the TfL Pension Fund, Dial-a-Ride, the London Transport Museum and London Overground. Each form names where to send it. The address above is the one on TfL's Customer Services form, which covers correspondence and calls about Oyster, contactless, the Tube, buses, the DLR, the Elizabeth line, London Overground, Santander Cycles, lost property and travel information. London Underground CCTV and body worn camera requests go instead to the LU CCTV Data Manager, London Underground Ltd, Floor 6 (6G5), Palestra, 197 Blackfriars Road, London SE1 8NJ. Check your online account before you ask. TfL says a registered Oyster or contactless customer can see their journey and payment history by signing in, and that road user charging customers can see vehicle, journey and payment history the same way. That is free and immediate, and it is most of what people want. Ask quickly if you want journey data or CCTV, because TfL publishes short retention periods. Oyster journey history is kept for between eight and nine weeks after the card was last used and is then disassociated from the card; contactless journey history is kept for 13 months; bus station CCTV is normally kept for 30 days. TfL also says a London Underground CCTV request must be specific about the exact time and the location within the train or station, and that requests across multiple cameras or long periods are likely to be refused as excessive. Two things on the network are not TfL's to give. CCTV inside a London bus is the responsibility of the company that runs that route, which is named on signs inside the vehicle. CCTV on London Overground stations and trains is the responsibility of First Rail London, which operates the network for TfL, and TfL publishes a separate form for requests to them. A request only reaches your own personal data, so it will not get you footage of someone else. TfL says it can disclose personal data relating to a third party, including CCTV, only in very limited circumstances, and that anyone who has been the victim of crime or anti-social behaviour on the network should report it to the police and ask the officer in charge of the investigation to request the footage from TfL, which has an established process for that. TfL asks you to use the relevant form or to email DPO@tfl.gov.uk, and says there can sometimes be delays in receiving post. It says requests will normally be answered within one month and that it will tell you if it needs to extend that. Its Data Protection Officer covers TfL and its subsidiaries, including London Underground Limited, Crossrail Ltd, the TfL Pension Fund and the London Transport Museum.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.