Guides · Freebies · Opt-out
Subject access request UK: who has my baby club data?
What can a baby-club SAR ask for?
The ICO's public SAR page calls this the right of access. You can ask whether an organisation is using or storing your personal information, and ask for copies. You can be specific. For a parenting club, the useful specifics are the due date, a child's date of birth, and who that file was disclosed to.
Swipe sideways for the full table
| Ask for | Why it matters on a baby-club file | Limit the ICO also publishes |
|---|---|---|
| Confirmation they hold your data, plus a copy | Shows the fields they still have (email, due date, baby's DOB, address) | They can refuse some material if an exemption applies |
| Identities of specific recipients | This is the “who has my data” line — named companies, not a slogan | If naming them is impossible or excessive, they must give categories of recipients instead |
| Purposes and categories of data | Separates “we emailed you offers” from “we passed a DOB to a broker” | They may point you at a privacy notice for some of this |
| How long they keep it, and the source if it did not come from you | Catches a pack claimed by a grandparent or a ward sign-up | You are entitled to your own information, not other people's |
Do not invent a 2026 partner list from a 2019 fine. Ask the club who received your file. The reply you want is names or, if they lawfully refuse names, categories — dated, and about your record.
How do I send a subject access request to a baby club?
The ICO says a request is valid if it is clear you are asking for your own personal information. You do not need a special form of words. Their public page still suggests a clean script.
- Find the privacy-notice contact Look up the club's current privacy page. That is where they name the email or form for access requests. Screenshot the page before you send.
- Use a clear subject line The ICO suggests “subject access request”, the date, your name (and any previous name), email, address, phone, and any membership or pack-claim number.
- Be specific about the file Ask for: a copy of the record; the due date and child's date of birth they hold; the identities of specific recipients of that data (or categories if they cannot name them); and dates of disclosure.
- Say how you want the reply Electronic copy is enough for most people. Keep a copy of what you sent. The ICO says organisations usually have one month from receiving the request, or from receiving ID if they ask for it.
You can send the same shape of request to a partner the club names. Each one is a new controller. A reply from the club does not empty those files.
Why is each recipient a separate controller?
The ICO's right-of-access guidance says controllers must answer SARs. A club that passed your details to a brand or a broker is answering for its own file. The recipient answers for the copy it now holds, and for anyone it disclosed to.
Privacy International's write-up of the Bounty investigation put the practical point simply: after you know a name, that company also needs its own request if you want to know whether it still has the data or passed it on. That is still the shape of UK access rights in 2026. It is not a one-letter wipe.
What did the ICO Bounty case show — and what does it not show now?
In April 2019 the ICO fined Bounty (UK) Limited £400,000 under the Data Protection Act 1998 for sharing personal information of more than 14 million people. The BBC and Privacy International both report the ICO's finding that about 34 million records went to 39 organisations between June 2017 and April 2018, including data about young children. The four largest recipients named in that decision were Equifax, Acxiom, Indicia and Sky. The other 35 were not named in the public write-ups.
That is history, and it is why parents still ask “who has my data”. It is not a current partner directory. Bounty told the BBC it had ended relationships with data brokers. Clubs change processors. The live list is the one the club returns on your SAR.
In shortSend a dated SAR to the club. Ask who received the due date and the baby's date of birth. Treat each named recipient as a new controller. Do not paste a 2019 recipient list into a 2026 letter and call it current.
Questions parents ask
- Do I have to pay for a SAR?
- The ICO says that in most circumstances an organisation cannot charge a fee. They can ask for ID. The clock for the one-month reply runs from when they have the request, or the ID, if they asked for it.
- Can I make a SAR for my baby?
- The ICO says you can make a request for someone else if you can prove you have permission. For a baby that is usually parental responsibility. The organisation can refuse if it is not satisfied you are allowed to see the file.
- The club only sent categories of recipients, not names. Is that allowed?
- The ICO says they must give specific identities except where that would be impossible or manifestly unfounded or excessive — in which case they must give categories instead. If the reply is only a slogan, write back and ask them to apply that test to your record.
- Does a SAR delete the data?
- No. Access is a copy-and-recipients request. Erasure and a marketing objection are separate rights. Ask for those in their own sentences if you want them too.
Sources
Official pages first. If this page and the official page disagree, the official page wins.
- ICO — Getting copies of your information (SAR) — checked 10 September 2026
- ICO — What is the right of access? (recipients; updated 8 December 2025) — checked 10 September 2026
- Privacy International — How a company illegally exploited the data of 14 million mothers and babies — checked 10 September 2026
- BBC News — Bounty pregnancy club fined £400,000 over data handling (12 April 2019) — checked 10 September 2026
- ICO — Investigation into data protection compliance in the direct marketing data broking sector — checked 10 September 2026
This is information, not a guarantee of any payment, and not medical, legal or product-safety advice for your home. Prices and rules change; figures carry the date they were checked. Recall status comes from official records only — a product we cannot find is not a safety all-clear. Tell us if we got a fact wrong.