Virgin Media has not complied with the UK GDPR and the Data Protection Act’s requirement to respond to Subject Access Requests (SARs) without undue delay, and at the latest within one month of receipt of the request.

Over a six-month period in 2021, Virgin Media received over 9,500 SARs. 19% of these were not responded to during the statutory timeframe, the ICO says. However, the company’s compliance has improved in 2022.

In 2021, the ICO received 125 complaints about Virgin Media’s handling of SARs.

The ICO has requested that Virgin Media meets the statutory deadlines, and to provide adequate staff resource to process SARs. Virgin Media is to report to the ICO about the improvements made within three months. A further report is required after six months.