Octopus Energy

Other United Kingdom Website Reviewed Sept. 22, 2026

UK renewable-focused energy supplier and technology company providing electricity and gas to domestic and business customers.

Report an issue with this profile

Compliance Frameworks

GDPR 2016/679
Partial
Privacy policy published; no public DPA template located.

Contact & Responsible Disclosure

Assurance position

No ISO 27001, ISO 9001, ISO 14001, Cyber Essentials or PCI DSS claim was found on octopus.energy or in Octopus Energy Group Limited’s 2024 annual report; their security page names no certifications.

Disclosure practice is the strongest of the energy suppliers reviewed: a HackerOne programme plus a direct security disclosure mailbox, with a stated two-business-day initial response and fortnightly updates.

Assess Octopus Energy in your own vendor risk programme

SnapGRC lets you send security questionnaires, track DPA status, manage sub-processors, and maintain a supplier risk register — all audit-ready.

Supplier Management Free Risk Register