Your data rights in brief
Your broadband provider holds a fair amount about you: your name and address, your bills, records of your contact with customer service, and your marketing preferences. UK data protection law (the UK GDPR and the Data Protection Act 2018) gives you rights over that information, while you're a customer and after you leave, for as long as the provider still holds it:
- Access: get a copy of what it holds, normally free and within one calendar month.
- Objecting to marketing: make it stop marketing to you. It can't refuse.
- Erasure: have data deleted, but only in certain situations.
- Portability: get data you provided in a machine-readable file.
- Complaining: to the provider, then to the ICO, the UK's data protection regulator. On 30 September 2026 the Information Commissioner's Office was replaced by a new body, the Information Commission, which still goes by the ICO name.
This guide uses the ICO's public guidance, the law as published on legislation.gov.uk and the privacy notices of BT, Vodafone and Virgin Media (checked October 2026). The ICO says some of its guidance is under review after the Data (Use and Access) Act 2025, so details may shift. It's general information, not legal advice.
What your provider holds and where to find out
Your best map is the provider's privacy notice (or privacy policy): the document explaining what it collects, why, who it shares it with and how long it keeps it. The ICO says contact details for data requests are usually there too.
BT's privacy policy publishes a retention table, a list of how long each kind of record is kept. Some rows that matter to most households (checked 9 October 2026):
Type of record (BT) | How long BT says it keeps it |
|---|---|
Marketing preferences, including contact details | 27 months from account closure |
General account details and bill summaries | 6 years |
Customer service records | Up to 6 years |
Details of disputes | 6 years |
BT adds that it may keep data longer where it has a legal obligation, such as to HMRC, or for legal claims. Other providers set their own periods, so check yours. Vodafone links a retention schedule from its privacy policy.
Technical data about your connection is a separate question, partly governed by other laws, and our guide to what your broadband provider can see about your internet use covers it.
How to get a copy: the subject access request
Asking for the personal data an organisation holds about you is a subject access request, or SAR (sometimes DSAR). The ICO says anyone can make one and you don't need a solicitor. Besides the data itself, you're entitled to know what it's used for, who it's shared with, how long it's kept, where it came from and whether it's used for profiling or automated decisions.
A SAR can be a useful way to get evidence for a dispute, such as records of what you were told about a fault. Our guide to complaining about your broadband provider explains why it pays to ask early if you may end up at the ombudsman.
What to put in your request
The ICO suggests including "subject access request" as the heading, the date, your full name (and any former names), email, home address and phone number, any account numbers, what information you want with dates or details that help find it, and how you'd like to receive it, including any accessibility needs.
You can ask for everything, but the ICO notes that being specific may get a faster, more useful reply. Since the Data (Use and Access) Act 2025, the law says you're entitled to what the organisation can provide from a reasonable and proportionate search (a change that applies back to 1 January 2024), another reason to point the provider at what matters.
Example wording, to adapt to your situation:
Subject access request. Date: [date]. Name: [name]. Address: [address]. Account number: [number]. Please send me a copy of the personal data you hold about me under Article 15 of the UK GDPR, in particular [records you want, with dates], with the information on purposes, recipients, retention and source. Please reply by email in a commonly used electronic format.
Where to send it
Start with the privacy notice. What the three we checked say (October 2026):
- BT says you can ask for a copy of your data at any time and, where you gave it under a contract or with consent, have it in a structured, commonly used, machine-readable format.
- Vodafone directs access requests to its Subject Access Request page or Customer Services, says its privacy query form isn't for SARs, and takes reasonable steps to confirm who you are first.
- Virgin Media says it won't charge for access requests in most cases. Its policy lists DataSubjectRights@virginmedia.co.uk for erasure, restriction and portability requests and its data protection officer at dpo@virginmedia.co.uk. The version we read (1.4) was last updated on 7 February 2023, so check the live page.
With any other provider, such as Sky or the smaller firms on our broadband providers hub, look for the rights or contact section of its privacy notice. The ICO says you can make a SAR online, by email, by post, by phone or face to face.
Keep a record, because the deadline runs from when the provider receives your request: screenshot an online form before submitting, keep copies and proof of postage, and note the date, time, staff name and any reference for phone requests. The provider may ask for ID, for example if you write from an email address it doesn't recognise.
Can the provider charge?
Normally, no: acting on your rights must be free. A provider can charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive, and it has to show that. The ICO's examples include using a request to harass, offering to drop it in return for something, or repeating a request too soon. A reasonable fee is also allowed for further copies. If a fee is charged, the time limit starts when you pay.
How long the provider has to reply
The ICO says an organisation must respond as quickly as possible and no later than one calendar month from the day it receives your request. Its examples:
Situation | When the reply is due |
|---|---|
Received 3 September | 3 October |
Received 31 March (no 31 April) | 30 April, the last day of the month |
Due date falls on a weekend or bank holiday | The next working day |
Three things can move the date:
- ID or other information: the clock starts once the provider has what it reasonably needs from you.
- An unclear request: the provider can pause the clock while it asks. The ICO says reply, even if only to say you won't give more detail.
- Complex or multiple requests: up to three calendar months in total, but the provider must tell you within the first month and explain why.
Virgin Media says it aims to reply to access requests within 30 days; that's its own target, and the legal limit is the calendar month.
What you should get back, and what can be held back
Alongside copies of your data, the ICO says the reply should cover the points listed above, plus how to ask for correction, deletion or restriction, your right to complain to the regulator, and safeguards for any transfers outside the UK.
Don't expect original documents. Providers only have to give your personal information within them, so you might get an extract or list. Other people's details can be redacted (blacked out), for example where account notes mention someone else in your household. Some information can be withheld under an exemption, such as legally privileged advice about a dispute involving you, and the provider should normally explain why and how to challenge it.
The reply should come in the format you asked for where possible, without making you install special software or collect it unless you agreed. If something is missing, it may have been deleted under the provider's retention rules; the retention schedule will tell you.
Stopping marketing from your provider
This is the clearest-cut of your rights. The ICO says you can object at any time to marketing sent to you by any form of communication, giving email, post and calls as examples, and the organisation cannot refuse. The law says this right must be brought to your attention clearly and separately, at the latest in the provider's first communication with you. If you ticked a box to receive marketing, you can simply withdraw that consent.
It doesn't cover market research or routine customer service messages, for example about your bill or a fault, which keep arriving while you're a customer.
Why you get emails you never agreed to
The likely reason is the soft opt-in, which lets a company you bought from, or discussed buying from, email you about its similar products, provided it gave you a simple way to opt out when it collected your details and every later message includes one. The ICO says it must stop once you opt out, and you can report it to the ICO if messages continue.
How to opt out with BT, Vodafone and Virgin Media
Provider | Ways to change marketing preferences (privacy notices, checked October 2026) |
|---|---|
BT | The unsubscribe link in a marketing email or text, your BT account, or by phone. |
Vodafone | Marketing preferences in My Vodafone (which it calls the easiest way), unsubscribe links, texting a code, telling a call adviser, app notification settings or Customer Services. You can opt out of everything or pick channels. |
Virgin Media | Marketing preferences in My Virgin Media. Former customers can access their online account for 180 days after full disconnection, or contact Virgin Media to opt out. You can object to any direct marketing use of your information, not just to receiving messages. |
Vodafone warns marketing may continue for a short time while records update, so allow a little time before chasing. With other providers, the unsubscribe link in a marketing email is the quickest start; where there's none, the ICO says use the contact details on the website or in the privacy notice.
Marketing calls and the TPS
Phone marketing is covered by the Privacy and Electronic Communications Regulations 2003 (PECR), which the ICO enforces. Under them a company must not make live sales calls to someone who has told it not to, or to a number registered with the Telephone Preference Service (TPS), the official opt-out register for sales calls, unless you have specifically consented to its calls. The ICO adds that this applies even to existing customers.
Regulation 21 adds two details. A company isn't in breach for calling a number that has been on the TPS register for less than 28 days, so allow four weeks after registering. And if you have told a company it may call you, it can keep calling your TPS-registered number until you withdraw that permission, which you can do at any time. If you once agreed to calls, tell your provider directly that you no longer want them.
Report unwanted marketing calls with the ICO's online tool, and silent or abandoned calls to Ofcom.
Be wary of callers who only claim to be your provider: our guide to broadband scam calls and emails explains what to look out for.
Objecting is not the same as deleting
Objecting to marketing doesn't automatically erase your data, the ICO says. The provider will probably add you to a suppression list, a record kept precisely so it doesn't market to you again. If you want other data deleted, ask separately.
After you leave: deletion and what providers keep
Leaving doesn't wipe your record. The privacy notices we checked say (October 2026):
- Vodafone keeps some information for a reasonable period after your contract ends in case you return, and may contact you about its services in that time if you haven't opted out of marketing.
- Virgin Media stores generic details (name and contact details) for up to two years after you stop being a customer, unless you ask it not to, so it can contact you in case you change your mind.
- BT keeps marketing preferences, including contact details, for 27 months from account closure.
So if you don't want to hear from a provider after leaving, switch marketing off before or as you go, while you can still log in. Our guide on how to cancel your broadband contract covers the rest of the leaving checklist.
When you can have your data deleted
The right to erasure (the "right to be forgotten") isn't absolute. The ICO says it applies only when the data is no longer needed for its original purpose; you withdraw consent; you object and your interests outweigh the provider's, or you object to direct marketing; the data was used unlawfully; there's a legal obligation to erase it; or it was collected from you as a child for an online service.
The ICO's example is a gym: once you cancel your membership, it no longer needs your details. A broadband provider is in a similar position for data held only to market to you, but not for everything.
Why your billing records are usually kept
An organisation can refuse erasure where it's legally required to keep data, for example under financial or other regulations, or needs it for legal claims. That's why BT keeps bill summaries and account details for six years. Vodafone says that after a contract ends it may still have lawful grounds to process your data, and suggests checking your contract has been terminated before asking for erasure.
A realistic request to an old provider asks it to:
- stop all direct marketing to you;
- delete data it no longer needs, such as data held only for marketing or in case you return;
- say what it's keeping, why and for how long;
- tell anyone it shared your data with about the erasure, or tell you who they are (the ICO says it should, unless that's impossible or disproportionate).
You can ask verbally or in writing, but the ICO says follow a verbal request up in writing; the one-month deadline applies. BT notes deletion from back-up systems may not happen straight away.
Taking your data with you: portability
Data portability lets you get electronic data you provided in a machine-readable format, such as a CSV file, and have it sent to another organisation where technically feasible. The ICO says it can include data gathered from monitoring your use, such as traffic and location data, and applies only where processing is based on your consent or a contract. For most households the practical use is keeping your bills: Vodafone gives downloading monthly bills from My Vodafone as an example. Download what you want before your online access ends. Portability doesn't delete anything, so ask for erasure separately.
If your provider ignores you or gets it wrong
Data protection complaints go through the ICO, separately from the ombudsman route for service and billing disputes. The ICO's steps:
- Chase. If more than a month has passed with no reply, extension or ID request, send a follow-up.
- Complain to the provider in writing (the ICO suggests email), saying what's missing or wrong, and keep copies. BT says complaints about its handling of personal data go to its data protection officer; Vodafone and Virgin Media also publish DPO contacts. The ICO says organisations have 30 days to acknowledge a data protection complaint, starting the day after they receive it, then must investigate, keep you informed and give an outcome without unjustified delay. That 30-day acknowledgement rule covers complaints, not the access request itself, which keeps its one-month deadline.
- Complain to the ICO. For an access request that went wrong, the ICO asks you to complain within three months of your last meaningful contact with the provider. For other data protection complaints its general advice sets no deadline but recommends letting the provider finish its own complaint handling first. The ICO publishes complaint templates, and its complaints page gives a helpline on 0303 123 1113.
The ICO can't act as your representative or award compensation, even if it finds the law was broken. For financial loss or distress you can ask the provider for compensation and, if it refuses, claim through the courts; the ICO strongly advises independent legal advice first.
If your data was exposed, lost or sent to the wrong person, see our guide on what to do after a broadband provider data breach.
Choosing a provider with your data in mind
If you're leaving partly because of how your data was handled, read the new provider's privacy notice before signing up, especially its retention periods and marketing after you leave, and untick marketing at sign-up.
When you are ready to move, you can compare deals at your postcode. The comparison comes from our partner; we don't switch you or rate providers on privacy, so the privacy notice is your best guide. For background on particular providers, see our pages for BT broadband, Vodafone broadband and Virgin Media broadband.
Broadband data rights FAQs
How long does my broadband provider have to answer a subject access request?
One calendar month from the day it receives your request: a request received on 3 September is due by 3 October, or the next working day if that's a weekend or bank holiday. The clock starts once the provider has anything it reasonably needs, such as ID. Complex or multiple requests can take up to three months in total, if it tells you within the first month.
Can my broadband provider charge me for a copy of my data?
Normally not: using your data rights is free. A provider can charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive, such as one repeated too soon, and it has to show that. It can also charge a reasonable fee for further copies, and the deadline then starts when you pay.
Can I make my old broadband provider delete my data after I leave?
Partly. You can ask it to erase data it no longer needs, such as details kept only for marketing, and it must stop direct marketing if you object. It can refuse to delete records it's legally required to keep, such as billing records, or data needed for legal claims. Ask it to say what it's keeping and for how long.
Will objecting to marketing delete my details?
No. The ICO says objecting to direct marketing doesn't automatically erase your data. The provider will probably keep you on a suppression list so that it doesn't market to you again. If you want other data deleted too, make a separate erasure request and ask which records it will keep and why.
Can I ask for the data on someone else's broadband account?
Yes, with their permission. The ICO says you can make a subject access request for someone else if you can show you're allowed to, for example with their written permission or a power of attorney, and the provider will check this. If the account holder has died, see our guide to broadband after a bereavement.
What can I do if my provider ignores my data request?
Send a follow-up once a month has passed, then a written complaint to the provider, ideally to its data protection officer, keeping copies. If that fails, complain to the ICO, the UK's data protection regulator, which asks you to do so within three months of your last meaningful contact with the provider about an access request. The ICO can't award compensation; for that, ask the provider and, if it refuses, go to court.
