Telecoms provider
Subject Access Request to Virgin Media
What Virgin Media holds about you, where to send the request, and what to expect back.
GetMySAR is an independent service and is not affiliated with, endorsed by, or acting on behalf of Virgin Media. The contact details below are published so you can make a request yourself free of charge.
Where to send your request
Verified 9 August 2026- Postal address
- Data Protection Officer Virgin Media Limited 500 Brook Drive Green Park Reading RG2 6UU
- Their own SAR form
- Open Virgin Media’s request form
- ICO registration
- Z9713406
- ID they ask for
- Virgin Media only asks for identity documents if what you put on the form does not match the account: it then asks for proof of identity (driving licence or passport) and proof of your address — a utility bill dated within the last three months, but not a Virgin Media bill. In most cases only the account holder can make the request. A third party asking by email has to attach a valid power of attorney or a letter of authority signed by the account holder, and a request made by phone needs the customer's consent on the call.
Source: Virgin Media published information. Organisations change these details — tell us if this is out of date.
Neither email address takes the request, and the answer file deletes itself in 14 days
The route. Virgin Media asks you to use its online subject access request form. Unlike some providers it does not put the form behind a login: the first question is who the request is for, and "I've never been a customer" is one of the three answers, so someone whose only record is a call Virgin Media recorded can use the same form. If you would rather write, the privacy policy's "How to contact us" address is the one on this page, and the policy's joint-venture section says you can use it to exercise any of your rights. Neither published mailbox is the access route, which is why this page prints no email address under "Where to send your request". DataSubjectRights@virginmedia.co.uk is scoped by Virgin Media to rectification, erasure, restriction, portability and objection — every right except access. dpo@virginmedia.co.uk is the registered Data Protection Officer contact, and Virgin Media's own SAR FAQ gives it for two things only: chasing a request that has missed its deadline, and challenging one that has been rejected. Use the form to ask, and dpo@ to chase. How the answer arrives, and the 14-day cliff. Virgin Media delivers a completed request through Kiteworks, a secure transfer portal. You create a Kiteworks account with an email address and password, then enter a passcode texted to your mobile to open the file. The data sits in Kiteworks for 14 days and is then removed automatically, so download everything the day the email arrives rather than the week after. The deadline and the fee. Virgin Media says 30 days and that it will "do our best"; the legal deadline is one calendar month and it is an obligation rather than an aspiration. Virgin Media also says it "won't charge a fee" in most cases — a subject access request is free unless the request is manifestly unfounded or excessive, or you ask for further copies. Call recordings expire in six months. Virgin Media keeps them for 180 days, the shortest window published by any of the UK networks on this site, and cannot supply a call where the caller did not pass security. Give the date and, if you can, the time and the number you called from. Some of what people ask for is not Virgin Media's to give. It tells people their MAC address is on their own device, their IP address is a web search away, and their browsing history is in their own browser. If a contract was opened in your name, Virgin Media names Cifas and Equifax as the agencies it shares with, and the record that decides the outcome is usually the fraud marker rather than Virgin Media's account file. An O2 mobile is a different request. Virgin Media and O2 are owned by the same joint venture and say in terms that they "remain separate controllers", so a household with both services has to ask each company separately. Somebody has died. Virgin Media's bereavement pages transfer or close the account and say nothing about records. Data protection rights end at death, so this is not a subject access request. A complaint is a different route again. Virgin Media's complaints page says so itself and sends access queries back to the privacy policy. After eight weeks a service complaint can go to CISAS; a complaint about how your data was handled goes to the ICO.
Making a request to a telecoms provider
Made under UK GDPR Article 15
Telecoms providers hold account and billing records, itemised usage, call recordings and chat transcripts from customer service, contact and complaint notes, and the credit checks run when the contract was opened.
Requests here usually follow a billing dispute, a contract taken out fraudulently in the person's name, or a complaint that went nowhere. Call recordings and chat transcripts are typically the useful part, because they show what was actually promised.
Records of who you called or messaged and when are traffic data, and a provider has to erase or anonymise them once they are no longer needed to carry the communication or to bill you for it. That is why usage records reach back months where account paperwork survives for years, and it is the main reason a request made long after the events comes back with less in it than the person expected.
What people commonly ask for
- Account and billing history
- Call recordings and live chat transcripts
- Customer service contact and complaint notes
- Credit checks run at contract opening
- Records of a contract you say you did not open
Watch out for
- Ask early. A provider has to erase or anonymise usage data once it no longer needs it, so the gap between the events you care about and the request often decides what comes back.
- Give the phone numbers, the dates and the approximate times you are asking about. A request that does not narrow the period tends to come back as billing data without the calls you actually wanted.
- Another person's number is their personal data as well as part of your record, so records of incoming calls and messages are commonly withheld or redacted, and some providers will release them only under a court order or witness summons.
- Providers carry your calls and messages but do not normally keep what was said in them, so a subject access request will not produce the content of a call or a text. Recordings of calls you made to the provider's own customer services are a different thing and can be asked for.
- A subject access request gets you the records; it does not get a bill or a service problem put right. Complain to the provider first — after six weeks, or once it issues a deadlock letter, one of the two Ofcom-approved ADR schemes will consider a service complaint free of charge, and which one depends on your provider. A complaint about how the provider handled your data goes to the Information Commissioner's Office instead.
Your rights, whoever you are asking
Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.
Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.
Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.
How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.
If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.
Send it to Virgin Media
You can do this yourself for free using the details above. If you would rather not handle the wording, the submission and the chasing, GetMySAR prepares, sends and follows up your request for a fixed £20 fee.
This page is general information about your right of access under UK data protection law. It is not legal advice. If your situation is complex or contested, consider speaking to a solicitor or contacting the Information Commissioner’s Office.