© GDPR EU 2026. All rights reserved.
Learn how Tesco Clubcard identifiers connect to personal data, what UK GDPR rights apply, and how to manage marketing, access requests and card privacy.
You show a Clubcard QR code at the till, check the prices and put your phone away. What happens to the information from that shop? For UK customers, it helps to understand the connection between a loyalty-card identifier and the records held behind it.
Table of Contents
There’s a difference between the QR code, the Clubcard account, and a Tesco account password. The image does not establish that a viewer can access the member’s account. A code without a printed name is not necessarily anonymous.
Keep images of your Clubcard out of public social media posts. If you’re having trouble scanning, use Tesco’s online support instead of posting the full QR code on a public platform.
The Information Commissioner’s Office states that an identifier can be personal data when it relates to someone identifiable, directly or indirectly. As such, an identifier that links to a named individual’s Clubcard account can be considered personal data in the retailer’s possession. That is an interpretation of the general definition of personal data, not a technical examination of the pictured code.
Hiding the printed membership number does not establish anonymity if the machine-readable identifier remains visible and can still be linked to an individual. The question is simply: can enough information still be gathered to connect to an identifiable individual?
Pseudonymisation also needs to be distinguished from anonymity. While replacing names with numbers reduces exposure, it is possible for individuals to continue to be identified through other means, according to the ICO. Therefore, pseudonymous data and anonymous data are not interchangeable.
Tesco’s current UK privacy and cookies policy identifies Clubcard numbers and related contact information as examples of “identity data”. Transactional information collected by Tesco includes items purchased, date purchased, location of purchase, and related points and benefits.
Additionally, Tesco outlines the use of shopper behaviour, including Clubcard activity, to segment customers into behavioural groups and personalise offerings. Furthermore, Tesco outlines various sharing arrangements for services, marketing, and analytic purposes with numerous partner organisations.
These are Tesco’s descriptions of their collection and usage practices, not an independent audit. To evaluate a particular use, read the relevant purpose, lawful basis and sharing sections together.
No. UK data protection law requires consent for certain uses of personal data. However, consent is not required for every use of personal data. Rather, under the ICO’s lawful basis guidance, the basis of processing varies depending on both the intended use and the circumstances surrounding that use. Consent, contract and legitimate interests are different lawful bases with different requirements.
A single consent does not provide permission for any later purpose an organisation chooses. The organisation must identify a valid lawful basis for each purpose for which it processes your data. Necessity is another factor. Just because something is convenient for an organisation does not mean it is necessary.
When reading a privacy notice, ask how your information is being used and which lawful basis is claimed for that purpose.
A general declaration that a loyalty scheme “uses consent” is far too vague to address these issues.
According to the ICO’s guidance on the right to object, companies cannot deny a consumer’s objection to the use of their information for direct marketing purposes. This protection does not extend to standard customer service messages.
Clearly state what you are asking for: stopping promotional emails or stopping a particular use of your information for marketing, for example. Document exactly what you requested and when you submitted your request.
Other objections depend on the circumstances. Where an organisation invokes legitimate interests as a lawful basis for processing your information, describe specifically which use of your information you object to and why. An objection to direct marketing does not imply that the organisation must delete all records; rather, it may create a suppression file so that it cannot send future marketing messages to you.
As explained in the ICO’s subject access guidance, you may ask an organisation whether it stores or uses your personal information, and request copies. A subject access request, or SAR, is a way to find out what is held about you. Be specific about the information you want and the dates. For a Clubcard enquiry, you could ask about purchases linked to your account during a particular period or personal information used to tailor offers. You should not assume that submitting a request will result in obtaining every single internal business document.
Submit your SAR using the contact details in Tesco’s current privacy notice. Please send identifying details privately; document your request; follow any reasonable checks on your identity; refrain from publishing your account details in a publicly accessible post while waiting for a response.
The right to erasure allows you to request deletion of personal data in specific circumstances. There are limitations and exceptions, however. Organisations may retain records for legal obligations or to establish, exercise or defend legal claims.
If you want records deleted, specify which information you mean and request an explanation if any is retained. Removing an application from your mobile device should not constitute conclusive evidence that the organisation has deleted your account or corresponding records.
Combining multiple loyalty cards into one app may be convenient; nevertheless, consider what personal information those apps are requesting from you. According to Tesco’s Clubcard safety guidance, third-party loyalty apps may collect and share personal information. Some may require account credentials, increasing the risk to your account.
Apps requiring a card identifier and those requesting your Tesco password warrant separate evaluation. Read the provider’s privacy notice before using the service. If their description is ambiguous do not assume Tesco exercises control over how that provider handles your information.
Before your next shop, review the privacy choices that matter to you. Keep your Clubcard details private. If you need an access request or a marketing objection, make it clear which action you want the organisation to take.
This guide concerns Tesco UK and UK GDPR. Sources checked on 7 October 2026. It provides general information rather than a finding about Tesco’s compliance or advice on an individual dispute.
