Privacy policy | Openreach

We’ve updated our privacy policy to reflect the changes in data-protection laws.

A note to customers of the communications providers we serve

Our main role is as a wholesaler providing services to communications providers to connect homes, mobile phone masts, schools, shops, banks, hospitals, libraries, broadcasters, governments and businesses – large and small – to the world. This privacy policy doesn’t apply to the personal information we process on behalf of those communications providers. Our contracts and the law determine what we can do with the personal information collected on behalf of communications providers. If you are a customer of theirs, then their privacy policy will apply to the collection and use of your personal information.

Why do we have a privacy policy?

Firstly, we are under a legal obligation to let you know what personal information we collect about you, what we use it for and on what basis. We always need a good reason and we also have to explain to you your rights in relation to that information. You have the right to know what information we hold about you and to have a copy of it, and you can ask us to change or sometimes delete it.

The reasons we collect information are set out in this privacy policy, but we are not telling you all this just because we have to. Some of what we do – be it contacting you as a representative of a communications provider or installing a connection to your home under an order made directly with us – involves the use of personal information. And we believe that it is very important for our customers to trust us with that information. We want you to be confident that we will keep it secure and use it both lawfully and ethically, respecting your privacy.

Our support for the right to privacy, as part of our broader commitment to human rights, is stated in our human rights policy. And our privacy policy explains in detail how we use your personal information. It describes what we do (or what we may do) from the moment you ask for a service from us, when we may use your information for credit-checking purposes, through to providing and billing for that service.

But whatever we do with your information, we need a legal basis for doing it. We generally rely on one of three grounds (reasons) for our business processing. Firstly, if you have ordered or take a service from us, we are entitled to process your information so we can provide that service to you and bill you for it.

Secondly, if we want to collect and use your information for other purposes, we may need to ask for your consent (permission) and, if we do, that permission must always be indicated by a positive action from you (such as ticking a box) and be informed. You are also free to withdraw your permission at any time. We tend to need permission when what is proposed is more intrusive.

But we do not always need permission. In some cases, having assessed whether our use would be fair and not override your right to privacy, we may come to the view that it falls within the third ground – our ‘legitimate interests’ to use the information in a particular way without your permission (for example, to protect our network against cyber-attacks). But when we do this we must tell you, as you may have a right to object, and we must consider further.

This is all set out in detail in this policy, which focuses more on those items that we think are likely to be of most interest to you. As well as covering processing for business purposes, we give you information on circumstances in which we may have to, or can choose to, share your information.

Our privacy policy

This privacy policy sets out how Openreach uses and protects your personal data. This privacy policy is provided in a layered format so you can click through to the specific areas set out below. Alternatively, you can download a copy of the policy here.

1. Important information and who we are
Privacy policy

This privacy policy gives you information about how Openreach uses and protects your personal data. Please read the policy carefully.

This privacy policy applies to personal data that Openreach processes in the course of its business, including where you are dealing with Openreach directly (for example, to arrange a wayleave or participate in our Fibre Community Partnership programme), using our website, visiting our premises, corresponding with us (e.g. calling our helpdesk or making an enquiry), giving us feedback or otherwise giving us your personal data.

Who are we?

Openreach Limited is the controller and responsible for your personal data (collectively referred to as "Openreach", "we", "us" or "our" in this privacy policy).

Openreach is a wholly owned subsidiary of BT Group plc (“BT Group”). The other companies of the BT Group have their own privacy policies which will apply to you if you buy your products or services directly from them. They can be found at the following links:

BT plc
EE Ltd
Plusnet plc

Data protection officer

We have appointed a data protection officer (“DPO”) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the DPO using this online form, or the information set out in the contact details section below.
2. The types of personal data we collect about you
Personal data means any information about an individual from which that person can be identified.

The types of personal data we collect about you depends on how you interact with us and for what purpose. We may collect different types of personal data about you as follows:

first name, last name, any previous names, username or similar identifier, title, date of birth, email address and telephone number;
address data;
technical data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website;
feedback, complaints and survey responses;
your communications with us, including emails, webchats and call recordings;
usage data, including information about how you interact with and use our website, products and services;
marketing and preference data, including your preferences in receiving marketing from us and our third parties and your communication preferences;
details about your visit to one of our premises (offices/buildings/exchanges), including CCTV footage;
details of products or services provided to you or at your property or any property you are responsible for or provide services to (e.g. where you are a managing agent of a multi-dwelling unit), whether those are provided by Openreach or a third party, including network services, such as fault monitoring or fault repair and products, such as telecare;
details of our network (such as faults on our network) and services provided on our network (to the extent that data is personal data);
details about your eligibility for and participation in our Fibre Community Partnership programme;
details relating to wayleaves, including the wayleave grantor’s status (tenant or freeholder), length of ownership of the property concerned and bank details, wayleave reference number, details about payments made under the wayleave agreement and details about who is served by the apparatus concerned; and
proof of identity documents, where relevant, including a copy of your driving licence, passport, bank statement or utility bill.

We also collect, create, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly or indirectly reveal your identity. For example, we may aggregate individuals' usage data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.
3. How is your personal data collected?
We use different methods to collect data from and about you including through:

Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise.
Automated technologies or interactions. As you interact with our website, we will collect technical and usage data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.
Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:
internet service providers;
analytics providers, such as Google Analytics;
advertising networks, such as Meta;
media agencies;
search information providers, such as Google;
review platforms, such as Trustpilot;
local authorities; and
publicly available sources, such as Companies House, the Land Registry and the Electoral Register.
4. How we use your personal data
Where we are a processor of your personal data

A note to customers of the internet service providers on the Openreach network

We’re often mistaken for internet service providers (like BT, Sky, Talk Talk etc.) but customers do not buy their phone or broadband service directly from us. We’re responsible for building and maintaining the UK’s largest broadband network.

At Openreach, our main role is as a wholesaler providing services to internet service providers (like BT, Sky, Talk Talk etc.) to connect homes, mobile phone masts, schools, shops, banks, hospitals, libraries, broadcasters, governments and businesses – large and small – to the world. This privacy policy does not apply to personal data where we process it on behalf of those internet service providers - our contracts with internet service providers and the law determine what we can do with that personal data.

If you are a customer of one of the internet services providers we provide services to, then their privacy policy will apply to our collection and use of your personal data where we are processing it on their behalf. A list of some of the internet service providers we work with can be found at the following link: Service providers on the Openreach network | Openreach.

There may also be circumstances in which Openreach processes your personal data as a controller, as set out below.

Where we are a controller of your personal data

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. Examples of legal bases that we might rely on include the following:

Performance of a contract with you: We may use your personal data where it is necessary to perform the contract we are about to enter into or have entered into with you.
Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure experience on our website. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to.
Consent: We rely on your consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use the various types of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Where we refer to our ‘customers’ we are referring to our internet service provider customers.

Purpose/Use

Legal basis

To register, provide our products/services to and manage our relationship with our customers

Necessary for our legitimate interests (to provide our products/services to our customers, to keep our records updated and manage our relationship with our customers)

Necessary to comply with a legal obligation

To manage our relationship with you, including investigating and dealing with your requests, feedback, reports, complaints and queries

Necessary for our legitimate interests (to manage our relationship with you, including appropriately investigating and dealing with your requests, feedback, reports, complaints and queries)

To enable you to partake in a prize draw or competition or complete a survey

Performance of a contract with you

Necessary for our legitimate interests (to study how customers and their customers use our products/services, to develop them and grow our business)

To administer and protect our business and this website (including troubleshooting, data analysis, testing, training, system maintenance, support, reporting, hosting of data and fraud, theft and crime detection, investigation and prevention)

Necessary for our legitimate interests (for running our business, provision of administration and IT services, network and cyber security, to detect, investigate and prevent fraud, theft and other crimes and in the context of a business reorganisation or group restructuring exercise)

Necessary to comply with a legal obligation

To deliver relevant website content and online advertisements to you and measure or understand the effectiveness of the advertising we serve to you

Necessary for our legitimate interests (to study how you use our website, and how customers and their customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)

To use data insights and analytics to improve our business practices, website, products/services, network, relationships and experiences and to measure the effectiveness of our communications and marketing

Necessary for our legitimate interests (to define types of customers for our products/services, to keep our website updated and relevant, to develop and grow our business and to inform our marketing strategy)

To send you relevant marketing communications and make personalised suggestions and recommendations to you about products, services, schemes or programmes that may be of interest to you

Consent

Necessary for our legitimate interests (to carry out direct marketing, develop our products/services and grow our business)

To carry out market research through your voluntary participation in surveys, feedback or reviews

Necessary for our legitimate interests (to study how customers and their customers use our products/services and to help us improve and develop our products/services and grow our business)

To exercise or defend our legal rights (including managing legal claims) or for insurance purposes

Necessary for our legitimate interests (to protect our business)

Necessary to comply with a legal obligation

To comply with our legal obligations, court orders and regulatory requirements (e.g. Ofcom requirements)

Necessary for our legitimate interests (to protect our business)

Necessary to comply with a legal obligation

To ensure the security, protection, maintenance, development and testing of our network (including managing the traffic on our network, and checking the lines for faults and line speed)

Necessary for our legitimate interests (to protect and grow our business)

Necessary to comply with a legal obligation

To carry out internal audits against our codes, policies, standards and Our Commitments

Necessary for our legitimate interests (to protect and grow our business)

To understand more about our network and build

Necessary for our legitimate interests (to build our network)

To correspond with you about your property or land or the property of others, where relevant (e.g. where required to manage/arrange the build of our network)

Necessary for our legitimate interests (to provide our products/services to our customers, to keep our records updated, to protect and grow our business)

To enter into a contract with you relating to your property or land (e.g. a wayleave agreement or contract relating to our Fibre Community Partnership programme) and to administer and enforce that contract (including managing payments, fees and charges and collecting and recovering money owed to us)

Performance of a contract with you

Necessary for our legitimate interests (to recover debts due to us)

To monitor our premises for security reasons and to keep you safe when you visit our premises

Necessary for our legitimate interests (to protect you and our business)

To use artificial intelligence (AI) to develop and grow our business and maximise efficiencies

Necessary for our legitimate interests (to develop and grow our business and maximise efficiencies)

To register your new development site and to provide you with information and services you have requested in respect of that new development

Necessary for our legitimate interests (to develop and grow our business and provide our products/services to our customers)

Performance of a contract with you

To validate your identity when you register to use our Developer Portal

Necessary for our legitimate interests (to keep our network and systems secure)

To check and inform you about your eligibility for our Fibre Community Partnership programme, to enable you to participate in the programme and to keep you updated about the programme

Consent

Necessary for our legitimate interests (to develop and grow our business and provide our Fibre Community Partnership programme)

Performance of a contract with you

Where you are a user of telecare services, to ensure you are not migrated to digital landline service without confirmation a compatible and functional telecare solution remains in place

Necessary for our legitimate interests (to assist our customers to keep their customers safe)

Purpose/Use

Legal basis

To register, provide our products/services to and manage our relationship with our customers

Necessary for our legitimate interests (to provide our products/services to our customers, to keep our records updated and manage our relationship with our customers)

Necessary to comply with a legal obligation

To manage our relationship with you, including investigating and dealing with your requests, feedback, reports, complaints and queries

Necessary for our legitimate interests (to manage our relationship with you, including appropriately investigating and dealing with your requests, feedback, reports, complaints and queries)

To enable you to partake in a prize draw or competition or complete a survey

Performance of a contract with you

Necessary for our legitimate interests (to study how customers and their customers use our products/services, to develop them and grow our business)

To administer and protect our business and this website (including troubleshooting, data analysis, testing, training, system maintenance, support, reporting, hosting of data and fraud, theft and crime detection, investigation and prevention)

Necessary for our legitimate interests (for running our business, provision of administration and IT services, network and cyber security, to detect, investigate and prevent fraud, theft and other crimes and in the context of a business reorganisation or group restructuring exercise)

Necessary to comply with a legal obligation

To deliver relevant website content and online advertisements to you and measure or understand the effectiveness of the advertising we serve to you

Necessary for our legitimate interests (to study how you use our website, and how customers and their customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)

To use data insights and analytics to improve our business practices, website, products/services, network, relationships and experiences and to measure the effectiveness of our communications and marketing

Necessary for our legitimate interests (to define types of customers for our products/services, to keep our website updated and relevant, to develop and grow our business and to inform our marketing strategy)

To send you relevant marketing communications and make personalised suggestions and recommendations to you about products, services, schemes or programmes that may be of interest to you

Consent

Necessary for our legitimate interests (to carry out direct marketing, develop our products/services and grow our business)

To carry out market research through your voluntary participation in surveys, feedback or reviews

Necessary for our legitimate interests (to study how customers and their customers use our products/services and to help us improve and develop our products/services and grow our business)

To exercise or defend our legal rights (including managing legal claims) or for insurance purposes

Necessary for our legitimate interests (to protect our business)

Necessary to comply with a legal obligation

To comply with our legal obligations, court orders and regulatory requirements (e.g. Ofcom requirements)

To manage our relationship with you, including investigating and dealing with your requests, feedback, reports, complaints and queries

To manage our relationship with you, including investigating and dealing with your requests, feedback, reports, complaints and queries

Necessary for our legitimate interests (to protect our business)

Necessary to comply with a legal obligation

To ensure the security, protection, maintenance, development and testing of our network (including managing the traffic on our network, and checking the lines for faults and line speed)

Necessary for our legitimate interests (to protect and grow our business)

Necessary to comply with a legal obligation

To carry out internal audits against our codes, policies, standards and Our Commitments

Necessary for our legitimate interests (to protect and grow our business)

To understand more about our network and build

Necessary for our legitimate interests (to build our network)

To correspond with you about your property or land or the property of others, where relevant (e.g. where required to manage/arrange the build of our network)

Necessary for our legitimate interests (to provide our products/services to our customers, to keep our records updated, to protect and grow our business)

To enter into a contract with you relating to your property or land (e.g. a wayleave agreement or contract relating to our Fibre Community Partnership programme) and to administer and enforce that contract (including managing payments, fees and charges and collecting and recovering money owed to us)

Performance of a contract with you

Necessary for our legitimate interests (to recover debts due to us)

To monitor our premises for security reasons and to keep you safe when you visit our premises

Necessary for our legitimate interests (to protect you and our business)

To use artificial intelligence (AI) to develop and grow our business and maximise efficiencies

Necessary for our legitimate interests (to develop and grow our business and maximise efficiencies)

To register your new development site and to provide you with information and services you have requested in respect of that new development

Necessary for our legitimate interests (to develop and grow our business and provide our products/services to our customers)

Performance of a contract with you

To validate your identity when you register to use our Developer Portal

Necessary for our legitimate interests (to keep our network and systems secure)

To check and inform you about your eligibility for our Fibre Community Partnership programme, to enable you to participate in the programme and to keep you updated about the programme

Consent

Necessary for our legitimate interests (to develop and grow our business and provide our Fibre Community Partnership programme)

Performance of a contract with you

Where you are a user of telecare services, to ensure you are not migrated to digital landline service without confirmation a compatible and functional telecare solution remains in place

Necessary for our legitimate interests (to assist our customers to keep their customers safe)

Expression of interest

If you have signed up to receive information from us about our build plans in your area and our other products, services, offers, schemes or programmes available in your areas, you can ask us to stop sending you this information at any time by following the “unsubscribe” link within any marketing communication sent to you or by contacting us using our online form.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes.

Online advertisements on third party sites

We may use your personal data to deliver relevant online advertising to you on third party sites, such as Facebook and Instagram, and to measure or understand the effectiveness of those advertisements and how you interact with them. We use third parties, such as Meta (who own Facebook and Instagram), to help us with this.

We do this on the basis that it is necessary for our legitimate interests to grow our business, to study how you interact with our online adverts and to inform our marketing strategy.

We may use the following to deliver online advertising to you and measure or understand the effectiveness of the advertising we serve to you:

information from Meta such as your postcode sector and aggregated demographic data; and
information about how you interact with our adverts and our website from cookies and similar technologies, such as the Meta pixel, placed on your connected devices (only where you accept Analytical, Preference & Marketing cookies on our website).

Further information on how Meta processes your personal data can be found in Meta’s Privacy Policy at: https://www.facebook.com/about/privacy.

Cookies

For more information about the cookies we use and how to change your cookie preferences, please see our cookie policy.

If you fail to provide personal data

If you fail to provide certain personal data when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to respond to your individual rights request).

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.
5. Who do we share your personal data with?
We may share your personal data where necessary with the parties set out below for the purposes set out in the table (Purposes for which we will use your personal data) above:

other companies within the BT Group;
third parties who provide us with services on our own behalf or help us to provide services to you or our customers, such as:
customer service, survey, marketing, infrastructure, information technology and payment service providers;
website and product analytics service providers; and
fraud prevention and detection service providers;

credit reference agencies (for identity checks only);
debt collection agencies;
government and law enforcement agencies, such as the police;
public authorities;
regulators, such as Ofcom and the Information Commissioner’s Office (ICO);
third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy;
our insurers and legal advisor;
internet service providers;
landlords and land owners; and
any other third party we are legally required to share your personal data with.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
6. International transfers
Transfers to BT Group companies

BT Group is a large multinational group of companies which operates internationally. Some of the processes involved in our use of your personal data for the purposes set out above will require your personal data to be stored or processed by BT Group companies located in countries outside of the UK. This may include countries where the level of legal protection is different to the UK and where you may have fewer legal rights.

To make sure your personal data is protected no matter which company in the BT Group holds that personal data, we have a group-wide arrangement, known as Binding Corporate Rules (“BCRs”). Our BCRs cover any transfers of personal data intra-group within the BT Group, and any transfers from our customers to a BT entity (which is protected by the UK/EU General Data Protection Regulation (GDPR)). There is one set of BCRs for transfers of data out of  the UK and another for transfers out of  the European Economic Area (EEA).

Transfers to non-BT Group companies (third parties)

We may also transfer your personal data to third parties who are outside of the UK for the purposes set out in the table (Purposes for which we will use your personal data) above.

Whenever we transfer your personal data to third parties outside of the UK, we always ensure that a similar degree of protection is afforded to it by ensuring that one of the following safeguards are in place:

we transfer your personal data to third parties in countries that have been deemed by the UK to provide an adequate level of protection for personal data, such as countries in the European Economic Area (EEA); or
we use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK.
7. How do we protect your personal data?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of such a breach where we are legally required to do so.
8. How long do we keep your personal data for?
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We have detailed internal retention policies that set out the various retention periods for different types of personal data we process. After a retention period has lapsed, the personal data is securely deleted, unless it is necessary to retain it for the establishment, exercise or defence of legal claims.

For example:

where we hold your personal data in connection with a wayleave agreement, we keep:
your contact details for the duration of the apparatus remaining in-situ and then for 12 years beyond the termination or expiry of the wayleave agreement; and
your bank account details (if provided) until such time as we are instructed by you not to (e.g. if you change to cheque payment); and

where we hold your personal data in connection with a repair or alteration agreement, we keep:
your contact details for the 7 years following creation of a repair or alteration case; and
a copy of your invoice and payment details for 7 years from the date of the invoice.

For further information regarding other retention periods, please contact us using the information set out in the contact details section below.

In some circumstances you can ask us to delete your data: see your legal rights below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this anonymous information indefinitely without further notice to you.
9. Your legal rights
You have a number of rights under data protection laws in relation to your personal data.

You have the right to:

Request access to your personal data (commonly known as a ‘data subject access request’ or ‘DSAR’). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data in certain circumstances (also known as ‘the right to be forgotten’). This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object or withdraw your consent to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request for erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
Object to processing of your personal data for direct marketing purposes at any time. This is an absolute right. (Please see the Expression of interest section above for details of how to object to receiving direct marketing communications).
Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information (i.e. not paper files) which you initially provided consent for us to use or where we used the information to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
Request restriction of processing of your personal data in certain circumstances. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:
if you want us to establish the data's accuracy;
where our use of the data is unlawful but you do not want us to erase it;
where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

If you wish to exercise any of the rights set out above, please do so by completing our online form or using the information set out in the contact details section below.

No fee usually required

You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
10. Contact details
If you have any questions about this privacy policy or about our use of your personal data or you want to exercise your legal rights, please contact our DPO in one of the following ways:

By completing our online form
By writing to:
Openreach Data Protection Officer
6 Gracechurch Street
London
EC3V 0AT
11. Complaints

If you want to make a complaint about how we have handled your personal data, please contact our DPO using the contact details set out above, who will investigate the complaint and report back to you. If after our response you are still not satisfied or believe we are not using your personal data in line with the law, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).
12. Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review. This version was last updated in May 2025.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.
13. Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy policies. When you leave our website, we encourage you to read the privacy policy of every website you visit.