In January 2026, Worldline UK issued an apology in relation to its handling of an ongoing data subject access request, acknowledging that aspects of its correspondence had caused “unintended anxiety” to the requester. The apology followed a series of exchanges concerning how the Sunject to Access Request (SAR) was being processed and how information was being communicated, and comes after earlier reporting by Loopline Media which examined the practical distinction between being told about personal data and being given access to copies of it.
The SAR request itself was made via email message November 2025 and was accepted by Worldline UK as valid. In earlier correspondence, the company correctly confirmed that a subject access request may be made verbally or in writing and that the method of submission is unrestricted. That acknowledgment matters, because once a request is validly made and identity verified, compliance turns on substance rather than format.
following that message, the handling of the request had already taken an unexpected turn. On 22 January 2026, the data subject was asked by the Worldline Data Protection Officer to provide a date of birth by return email as a “quick verification question.” This request was made despite passport identification having already been provided in December 2025, and expressly confirmed at the time as satisfactory for identity verification purposes.
Shortly afterwards, the request for the date of birth was withdrawn without explanation, with the data subject being told simply to “disregard the request”. When a direct and reasonable follow-up question was posed, asking why the date of birth had been requested in the first place, and what would happen to that data given it had been supplied, no answer was provided. To date, that question remains unanswered.
This sequence matters not because of the information requested, but because of what it illustrates about the Worldline process. Transparency is a core requirement when organisations process personal data, particularly where additional information is sought after identity has already been verified. Requests for further personal data should be clearly justified, proportionate, and explained at the time they are made. The unexplained appearance and disappearance of an identity request, followed by silence when clarification was sought, introduced further uncertainty and anxiety into an already protracted Worldline UK process.
It was against this background of shifting requirements, unanswered questions, and unclear process that the automated OneTrust email was later sent, stating that “one more step” was required before work on the request could begin. It was in response to this accumulation of procedural friction, rather than any single communication in isolation, that Worldline UK apologised for the “unintended anxiety” caused by the handling of the request.
The use of the OneTrust system introduced a number of practical complications. While the platform itself is not inherently problematic, its deployment in this context added additional procedural layers to a request that should have been straightforward once identity had already been verified by appropriate documentation.
It is understandable why large organisations may favour dedicated portals to manage access requests. Such systems can support internal tracking, auditability, and secure transmission at scale. However, organisations are also required to consider the needs of all categories of data subjects, including those who are less technically confident, who rely on assistive technologies, or who reasonably prefer direct correspondence.
In this case, the automated email generated by the portal was routed to junk mail folders, increasing the risk that it could be overlooked altogether. Its wording also implied that substantive work on the request depended on the data subject engaging with the platform, despite the request already being live and overdue. By contrast, email correspondence can be both familiar and accessible to a wider range of users, and security concerns can be addressed through established measures such as password-protected or encrypted attachments.
Seen in that light, the use of an additional platform was not inherently wrong, but it introduced avoidable friction into a statutory process that is intended to be straightforward, transparent, and proportionate once identity has been verified.
The Worldline UK Apology
The apology sits within a wider exchange that remains unresolved. Loopline Media will be reporting on the process to highlight what data subjects go through with organisations such as Worldline UK. The material supplied by Worldline UK so far consists primarily of a descriptive schedule setting out categories of personal data, purposes of processing, and recipients. What has not been provided are copies of the documents or records in which the personal data appears. No claim of legal professional privilege or other exemption has been relied upon to justify that omission. The requester has raised the distinction between a summary of data and access to the data itself, a distinction that goes to the meaning of the right of access under Articles 12 and 15 UK GDPR.
Despite the apology, subsequent correspondence has continued to be routed through the OneTrust portal, notwithstanding clear requests that responses be provided by email only.
How Worldline UK responds to that position will determine how this request ultimately concludes. Until then, the correspondence continues to offer a live illustration of how data protection rights are experienced in practice, shaped not only by statute but by the systems and processes through which they are delivered.
Disclaimer
This article is published for informational and public-interest purposes only. It does not constitute legal advice, regulatory guidance, or a determination of compliance or non-compliance with the UK GDPR or any other data protection legislation.
The article does not allege wrongdoing by Worldline UK, any other Worldline entity, or any individual. It reports on and analyses a sequence of contemporaneous correspondence relating to a live data subject access request, including statements made by Worldline UK in that correspondence. References to an apology for “unintended anxiety” reflect the language used by Worldline UK and are reported factually and in context.
All opinions expressed are those of the publisher and are based on the materials available at the time of publication. Where questions are raised about process, transparency, or accessibility, they are framed as matters of public interest and regulatory interpretation, not as findings of fault.
Documents and correspondence referred to or reproduced are published accurately and without alteration, save for the redaction of personal contact details and other identifying information where appropriate. Readers are invited to draw their own conclusions.
Nothing in this article should be relied upon as a substitute for professional legal advice. Individuals concerned about their data protection rights should seek independent advice or contact the Information Commissioner’s Office.
