Subject Access Request to Vodafone

There is no separate page for the form. On the page linked above, click "Use our online form" and it opens where you are. Vodafone says it will process the request and email you within one calendar month. If you would rather write, its guidance notes are the current document behind the form and are worth reading first. Vodafone UK and Three merged, and that did not merge your data rights. Vodafone's privacy policy says that in June 2025 Vodafone Limited and Three UK "merged and are now part of VodafoneThree Group", and that the two "remain separate Data Controllers", with some processing now done jointly. So a Three account is still a request to Three, and this page is the route for a Vodafone one. The ICO register says the same from the other side: Vodafone Limited and Hutchison 3G UK Limited, which trades as Three, hold separate live registrations, and there is no VodafoneThree entry in it at all. VOXI is the same company rather than a different one. Its privacy policy states "We are Vodafone Limited. VOXI is a sub-brand of Vodafone Limited", gives the same ICO registration number as the one above, and sends VOXI customers to this same request form. Check what you can already see before you ask. Vodafone publishes up to 36 months of past bills inside a My Vodafone account, and its guidance notes ask you to try customer services or its complaints process first where the real problem is a billing or service dispute — a subject access request will get you the records but will not put a bill right. If you want the wording for a request rather than the form, the free letter builder will produce one. Vodafone states plainly what a request will not produce. On content: "We're unable to provide you with information about the content of any calls, voicemail, texts or other messages. We don't record the content of the calls you make, or the content of your messages." On contracts: a signed copy is only available to Pay monthly customers, and only depending on when and how the contract was taken out and whether it was stored digitally, though terms, conditions and plan information can be supplied. The retention windows decide whether asking is worth it. Records of incoming calls, texts and picture messages are kept for 12 months only, and Vodafone will not release them with the caller's number without a court order or witness summons, because that number is someone else's personal data. For a registered Pay as you go account it says it can only provide information for the last 12 months, or back to the date the mobile was registered if that was more recent. For an unregistered Pay as you go account it says it cannot verify who you are and will disclose nothing without a court order, and registering now only opens up information from the date you register. Call recordings are the most time-sensitive records here, and Vodafone's two current documents disagree about how long they survive. The guidance notes say recorded calls are "generally only retained for up to 12 months (it can be less, depending on the nature of the call)". The downloadable form says "Recorded calls are only kept between 3 and 120 days" and that "most are kept for 60 days". Both are linked from the request page. Plan around the shorter figure: if a call matters, ask within weeks. Vodafone also asks for the numbers you called it from and the date and time, and says that without them it will search only the mobile number on the request. One narrow route is almost never mentioned anywhere else. If you have been charged with a driving offence involving mobile phone use, Vodafone will supply your outgoing calls, texts and picture messages, and your incoming ones with the originating numbers removed, to help you in court — the 12-month limit applies to the incoming data — provided you attach proof that the police have charged you. Only individuals can use this route. Vodafone says businesses and corporate accounts cannot make a subject access request; sole traders can, and so can an authorised third party such as a solicitor, carer or relative acting for an individual. A business account goes to customer services or an account manager instead. For someone who has died this is not the right process, because data protection rights end at death. Vodafone directs relatives and executors who need account information to administer an estate to its bereavement team on 03333 048050, at standard call charges. Vodafone publishes three postal addresses and they are easy to confuse. The one above comes from its Your privacy rights page, is marked for the Privacy Team, and is the address for writing about your personal information. Complaints go to a different addressee at the same Newbury office. And the downloadable form prints a third address, Customer Relations, Vodafone Ltd, Shelton Boulevard, Stoke-on-Trent, ST1 5GP, alongside the email address above; if you post that form, use the address printed on it. That form was last changed in October 2021 and still gives a 30-calendar-day response time, which the guidance notes correct to one calendar month, so read the rest of it with that date in mind. Vodafone also says you can ask by phone on 191 or 0333 304 0191, but that is its general customer services number and the complaints page gives the same one, so there is no dedicated subject access line. A contract opened fraudulently in your name usually leaves a record in two places: Vodafone's own file, and a fraud marker held by Cifas, which is a separate organisation and needs a separate request. If what comes back looks thin, check the response against what you asked for, and what to do if an organisation does not comply sets out the next step.

Made under UK GDPR Article 15

Telecoms providers hold account and billing records, itemised usage, call recordings and chat transcripts from customer service, contact and complaint notes, and the credit checks run when the contract was opened.

Requests here usually follow a billing dispute, a contract taken out fraudulently in the person's name, or a complaint that went nowhere. Call recordings and chat transcripts are typically the useful part, because they show what was actually promised.

Records of who you called or messaged and when are traffic data, and a provider has to erase or anonymise them once they are no longer needed to carry the communication or to bill you for it. That is why usage records reach back months where account paperwork survives for years, and it is the main reason a request made long after the events comes back with less in it than the person expected.

• Account and billing history
• Call recordings and live chat transcripts
• Customer service contact and complaint notes
• Credit checks run at contract opening
• Records of a contract you say you did not open

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.