File a Subject Access Request

A Subject Access Request (SAR) is how you ask any organisation to give you the personal data they hold about you and information about how they use it. In the UK, your right of access is set out in the UK GDPR and the Data Protection Act 2018. Organisations usually have one month to respond (they can extend by up to two months if the request is complex) and it’s generally free of charge.

In ECO4/retrofit cases, your data is often spread across multiple organisations. Typical targets include:

• Your Installer
• Scheme & oversight bodies (e.g., TrustMark, Ofgem, DESNZ)
• Accreditation & certification bodies (e.g., MCS, NICEIC/Certsure, NAPIT, Stroma)
• EPC & Retrofit accreditors (e.g., Elmhurst, ECMK, Quidos)
• ADR/ombudsman services you’ve interacted with (e.g., Dispute Resolution Ombudsman, HIES)
• Your obligated energy supplier under ECO4 (find their Data Protection/Privacy contact in their privacy policy)

Send your SAR to the organisation’s Data Protection Officer (DPO) or the email listed in their Privacy page. You can make SARs by email; you don’t need to use a special form.

Ask for all personal data relating to you and your property, in any system or format, plus the Article 15 “right of access” details (purposes, categories, recipients, retention, source, and any automated decisions). You can also be specific to save time:

• All surveys, site notes and photographs (e.g., damp, ventilation, air-tightness, roof, property condition)
• Heat-loss calculations (with inputs/assumptions), room-by-room designs, and all design changes/variations
• Commissioning data, as-built documentation, warranties/registrations
• TrustMark/MCS/EPC lodgements and any technical monitoring/audit records (EPC XMLs, QA comments, invalidations)
• Complaint logs, internal correspondence, and call recordings referencing you or your address

• Time limit: one month to respond (with a possible two-month extension for complex requests)
• Format: electronic copies are common (ZIP/secure link)
• ID checks: reasonable proof of identity/address may be requested
• Redactions: limited redactions (e.g., third-party data, legal privilege) must be explained
• Fees: usually free; fees apply only if a request is manifestly unfounded or excessive

If you don’t get a complete response within the time limit, or it’s refused without good reason, you can complain to the ICO:

Make a data protection complaint to the ICO  |  ICO Helpline: 0303 123 1113 (Mon–Fri, 9am–5pm)

• UK GDPR – Article 15: Right of Access
• Data Protection Act 2018 – UK implementation and exemptions
• ICO guidance – practical detail on scope, timelines and format