GDPR Support

What are your rights as a Large Business or Partner?

We may be able to support your business with any requests you receive from individual end users to exercise their data subject rights, to the extent we process personal data about them and your business needs our assistance with these.

Individuals working for large businesses and partners will also have access to these individual rights under the privacy laws to the extent we process personal data about them.

Individuals have the following rights under privacy laws:

  • Right to access - The right to access personal data that we hold about them as a data controller;
  • Right to be forgotten - In certain circumstances, the right to request that their personal data be erased from the systems within our control;
  • Right to rectification - The right to have their personal data that we hold as a data controller corrected;
  • Right to withdraw consent - Where they have consented to specific uses of their personal data, for instance with marketing preferences, the right to withdraw their consent at any time;
  • Right to object to or restrict processing - In certain circumstances, the right to object to or request that we restrict our processing of their personal data; and
  • Right to data portability – The right to receive certain personal data about them in a machine-readable format.
Right to access

This right is also known as a Subject Access Request or a SAR.

This allows an individual to obtain a copy of personal data held by a business and enables individuals to be aware of, and to be able to verify the lawful processing of, their personal data.

To comply with such a request, businesses must provide the personal data within a month of the request. Where requests are complex or numerous this can be extended by a further two months.

Supporting you with requests by your individual end users

As a data controller, your business may receive a SAR from an individual. If we process personal data for you about this individual, we will make this personal data available to you at your request.

To ensure you meet your regulatory deadline, we would ask that you let us know as soon as practicable to do so, providing:

  • details that allow us to identify the individual;
  • the date that the SAR was first received;
  • details of any specific personal data requested (for example billing information); and
  • who we can contact if we have queries about your request.

What will you receive?

Once we have gathered the personal data requested, we will provide you with a data pack for you to review and use as you see fit to fulfil the SAR.

How to request

Requests should be sent to TTBGDPRrequests@talktalkbusiness.co.uk.

Thinking of making your own Subject Access Request?

It’s free to exercise this right; however:

  • if you request large amounts of personal data, we can ask you to specify the personal data that the request relates to and, if you don’t do this, we may deem your request excessive; and
  • if we deem your request excessive, e.g. because you won’t narrow your request as noted above or because your request is repetitive, we may refuse to comply with your request or we may request that you make a payment to cover our administration costs.

We will let you know if there are any issues with your request once we have reviewed it, including whether we require a payment as we have deemed your request excessive.

We will confirm to you as soon as we have completed your request. This will be within one month of our receipt of your request and any required proof of identity. If your request is complex and we need more time (as permitted under the privacy laws), we’ll let you know.

How to request

Send us your request to TTBGDPRrequests@talktalkbusiness.co.uk or speak to your Account Manager.

Right to be forgotten

What is this right?

The right is also known as the right to erasure.

An individual can request the deletion or removal of their personal data if:

  • the personal data is no longer necessary for the purpose which it was originally collected it for;
  • the controller is relying on consent as its lawful basis for holding the data, and the individual withdraws their consent;
  • the controller is relying on legitimate interests as its lawful basis for processing, the individual objects to the processing, and there is no overriding legitimate interest to continue the processing;
  • the controller is processing the personal data for direct marketing purposes and the individual objects to that processing;
  • the controller is processing the personal data unlawfully; or
  • the deletion is required to comply with a legal obligation.

The Information Commissioner’s Office (ICO) will be satisfied if that personal data has been ‘put beyond use’, if not actually deleted. You should refer to the ICO’s website for further information on this.

The right to be forgotten does not provide an absolute right to be forgotten. Organisations can refuse to comply with a request in certain circumstances, including where the personal data is processed:

  • to comply with a legal obligation; or
  • for the establishment, exercise or defence of legal claims.

In certain circumstances, individuals have a right to request that their personal data be erased from your business.

Supporting you with requests by your individual end users

As a data controller, your business may receive a request from an individual to have their personal data erased and your business will have to decide whether to refuse or accept the request. If you decide to accept the request, and if we process the individual’s personal data for you, you can ask us to delete any personal data we hold.

To ensure you meet your regulatory deadline, we would ask that you let us know as soon as practicable to do so, providing:

  • details that allow us to identify the data subject in our records;
  • the date that the right to be forgotten request was first received;
  • Details of any specific personal data requested to be erased; and
  • Who we can contact if we have queries about the request.

Your request should be sent to TTBGDPRrequests@talktalkbusiness.co.uk.

Please note that it will be your responsibility to verify the identity of the requestor and determine whether you will accept or reject the request.

What will you receive?

We will notify you when the personal data has been deleted or ‘put beyond use’.

If for any reason we are unable to fulfil your request, or we decline a request where we have legitimate grounds for refusal, then we will notify you.

Thinking of making your own Right to Be Forgotten Request?

It’s free to exercise this right.

You can request that your personal data is removed by submitting a request to TTBGDPRrequests@talktalkbusiness.co.uk or speak to your Account Manager.

We shall confirm to you as soon as we have completed your request. This will be within one month of our receiving your request and any required proof of identity. If your request is complex and we need more time (as permitted under the privacy laws), we’ll let you know

If for any reason we are unable to fulfil your request, or we decline a request where we have legitimate grounds for refusal, then we will notify you.

Right to rectification

What is this right?

Individuals have the right to have their personal data rectified if it is incomplete or incorrect.

Supporting you with requests by your individual end users and support for you as an individual

Updating customer details and records is an everyday part of our business processes at TalkTalk.

If your personal data changes or you identify an error in any personal data we hold, speak to our contact channels if you are unable to rectify it directly.

In some instances, we may require additional evidence to prove your identity before applying changes. We will let you know if this is the case.

Right to withdraw consent

What is this right?

Where individuals have consented to specific uses of their personal data, for instance with their marketing preferences, they have the right to withdraw their consent at any time

Supporting you with your consent

In order to meet our obligations under privacy laws, we need consent to market to individuals. We won’t be able to contact individuals directly about any new products we launch, or promotions and offers that are relevant to them, if we do not have such consent.

How to change your consent choices

You will be able to update your consents at any time through a variety of methods, including:

  • by contacting your account manager;
  • calling our customer service team or our sales teams;
  • accessing your online Support Centre account; or
  • by clicking on the link at the bottom of every marketing email you receive from us.

You can also choose how we contact you, for example by email, telephone or SMS.

Supporting you with individual end users

We don’t believe we can help with such requests from your individual end users as their requests will relate to what you do as a controller; however, if you feel we are able to help, please send us your request to TTBGDPRrequests@talktalkbusiness.co.uk or speak to your Account Manager.

Right to object to or restrict processing

Individuals have the right to object to processing of their personal data in certain circumstances, e.g. if you are processing for legitimate interests or for direct marketing, including profiling.

Thinking of registering an objection or requesting processing is restricted?

When you do register an objection, please be aware that this may impact what we can do with your personal data e.g.:

  • any product and service recommendations are likely to be less relevant as these are typically based on how you’ve used our services;
  • offers are typically based on your behaviour and therefore may be less relevant if we cannot process all the personal data we hold;
  • we will not be able to use feedback from you to improve the service we provide to you and other customers; and
  • we will not be able to use your personal data in determining how effective our communications are.

Additionally, you have the right to request that we restrict the processing of your personal data, e.g. if your personal data is not accurate.

How to request

To register your objection simply request this when speaking to an advisor or your Account Manager.

Supporting you with requests by your individual end users

We don’t believe we can help with such requests from your individual end users as their requests will relate to what you do as a controller; however, if you feel we are able to help, please send us your request to TTBGDPRrequests@talktalkbusiness.co.uk or speak to your Account Manager.

Right to data portability

Individuals are able to obtain and reuse their personal data for their own purposes across different services.

Thinking of making a Data Portability Request

If we can assist, we will provide your individual end user’s personal data free of charge, in a structured, commonly used and machine-readable format so that you and other organisations are able to use the personal data.

The type of personal data we provide under this right includes: title, name, installation address, correspondence address, landline number, mobile number and email address.

How to Request

It’s free to exercise this right.

You can request that your personal data is ported to you by submitting a request TTBGDPRrequests@talktalkbusiness.co.uk or by speaking to your Account Manager.

We shall confirm to you as soon as we have completed your request. This will be within one month of our receiving your request and any required proof of identity. If your request is complex and we need more time (as permitted under the privacy laws), we’ll let you know

If for any reason we are unable to fulfil your request, or we decline a request where we have legitimate grounds for refusal, then we will notify you.

Supporting you with requests by your individual end users

We don’t believe we can help with such requests from your individual end users; however, if you feel we are able to help, please send us your request to TTBGDPRrequests@talktalkbusiness.co.uk or speak to your Account Manager.

Acceptable identification documents

Documentation required is listed below:

Proof of Identity:

  • Birth Certificate;
  • Driver’s License;
  • Passport – New chipped passports must be scanned and, if the request is sent via post, printed due to reflective surface;
  • Utility Bill addressed to you; or
  • Credit or Debit Card Statement addressed to you.

AND one of the following:

Company related documentation:

  • Invoice of the company.

Or if you are requesting your data as an employee we also need you to provide a Proof of Address

  • Utility Bill addressed to you; or
  • Credit or Debit Card Statement addressed to you.
  • Council Tax bill addressed to you, dated within the last 3 months and showing an address matching the one used on your request

Please Note

A utility bill or Invoice must not be from TalkTalk Group. The bill/statement needs to be addressed to you, dated within the last 3 months and showing an address matching the one used on your request.

If you are requesting your data as an employee or if the business does not currently receive a service through TalkTalk Business, we also need evidence to demonstrate that you are employed by the company.