Subject Access Request to Thames Water

Thames Water publishes two data protection email addresses and they do different jobs. A request to exercise a right — access, rectification or erasure — goes to subject.access@thameswater.co.uk. General questions about how it uses personal data go to data.protection@thameswater.co.uk, which is not the request route. Thames Water publishes a response time of its own, and it is not quite the standard one. It says it will comply within one calendar month, counted from when it receives the request or any additional information it has asked for, unless the request is complex — in which case it says it will write within that month to tell you the response period that will apply, which may be up to three months. Call recordings are often the useful part of a water billing dispute and they do not last. Thames Water says it keeps telephone recordings of customer calls for up to 12 months, depending on the type of call, so a request made long after the calls you care about will come back without them. Expect redactions of a kind particular to a water company. Thames Water says it can only supply personal data that is about you, and that where another person can be identified in a document it blacks that part out — naming employees' names and contact details and neighbouring property information as examples. It also says it does not provide interactions you have had with its social media teams, on the basis that those are already available from your own social media history. Redaction is normal and is not the same as a refusal. Neither telephone number Thames Water publishes is a way of making a request. 0800 980 8800 is for opting out of marketing, and the customer services contact centre line is given for updating your details. Requests are made by email or by post. The controller is Thames Water Utilities Limited, the licensed water and sewerage undertaker. Thames Water Limited is a separate holding company at the same address, and naming the wrong one is a common way to slow a request down. Thames Water asks you to come to it before the regulator. Its published data protection escalation is to email the company first, then its Data Protection Officer if you are unhappy with the reply, and only then the Information Commissioner's Office — a separate ladder from the service complaint route for a bill, a leak or a pressure problem.

Made under UK GDPR Article 15

Energy and water suppliers hold account and billing history, meter readings and smart meter consumption data, contact and complaint notes, call recordings, and records of any debt recovery or vulnerability flags applied to the account.

Requests usually follow a billing dispute, a back bill or debt collection activity, and the meter and billing history is normally the point of them. Where the argument is about energy, Ofgem's back billing rules say you do not have to pay for energy used more than 12 months ago if you had not had an accurate bill for it before, had not been told what you owed through a statement of account, or your direct debit had been set too low to cover it. That makes the dates on which the supplier actually billed you, and what those bills said, the facts the dispute turns on — which is what a request gets you. The protection is lost if you acted unreasonably, for example by blocking access to the meter, ignoring requests for payment or stealing energy.

Where an account has been passed to a debt collection agency, that agency is usually a separate data controller and needs its own request.

• Billing and payment history
• Meter readings and smart meter consumption data
• Contact notes and complaint records
• Debt recovery correspondence and internal notes
• Vulnerability or priority services register entries

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.