Subject Access Request to Aviva

Aviva is a group of separately registered companies rather than one. Its privacy policies say the controller is the Aviva group company that underwrites your policy, and tell you to check your own policy documents for which one that is. The subject access route is the same whichever it turns out to be. Aviva's form splits at the first question: one branch if you are asking about your own data, another if you are asking on behalf of someone else. On the second, Aviva asks for your relationship to the person and says it will be in touch for a copy of their consent document before it can proceed. The form lets you name what you want — quotes, policy, claims, calls, complaints data, all data, or something you describe yourself — and asking for calls is what gets you the recordings. Aviva offers four ways to receive the answer: a secure online portal powered by Box, password-protected email attachments with the password sent separately, a USB stick or audio CD by signed-for delivery, or paper by signed-for delivery. It also asks whether any of your policies came through an employer's scheme. MyAviva is where Aviva says you can view your policies and check what is covered, and that needs no request at all. The claim file, the internal notes, the call recordings and the complaints data are what the subject access form's own categories are for. Aviva publishes DATAPRT@aviva.com for questions about how to exercise your rights and for raising a concern about how it has handled your information. Its subject access sentence offers the online form or a letter to the postal address and does not offer that mailbox, so this page does not list it as a place to send a request. A request made in writing is valid however you send it. Aviva names the Motor Insurers' Bureau as the data controller for the Motor Insurance Database, and lists the Claims Underwriting Exchange among the databases it shares claims data with. The Motor Insurers' Bureau says on its own site that the Claims and Underwriting Exchange is one of its databases, so a single request to MIB covers both. Separately, Aviva says it gives your driving licence number to the DVLA to confirm your licence status, entitlement and any endorsements. Data protection rights end when someone dies, so a subject access request cannot be used to get a deceased person's records, and Aviva's subject access forms say nothing about death, executors or probate. Aviva runs a separate bereavement notification route instead, and says it may need details from the death certificate or the grant of probate. A subject access request gets you the records; it does not get a claim decision reviewed. Aviva says it will give you a written response within 8 weeks of a complaint, and that you can go to the Financial or Pensions Ombudsman Service depending on what your complaint is about. The Financial Ombudsman Service expects you to have complained to Aviva within six years of the problem or three years of realising you had cause to, and gives you six months from the date on Aviva's final response to bring it to them.

Made under UK GDPR Article 15

An insurer's claim file usually contains far more than the correspondence you have seen: internal claim notes, loss adjuster and investigator reports, underwriting and pricing records, surveillance where it was commissioned, and any medical evidence obtained.

These requests are usually made during a dispute about a declined or underpaid claim. That timing matters, because material created once litigation was in contemplation may be withheld under the legal professional privilege exemption in Schedule 2, Part 4 of the Data Protection Act 2018.

Insurers also share data through industry databases that other organisations run, so records held there need their own requests. The Claims and Underwriting Exchange and the Motor Insurance Database are both operated by the Motor Insurers' Bureau, which now runs the vehicle register under the name Navigate, so a single request to MIB covers both. The Insurance Fraud Register is managed and administered by the Insurance Fraud Bureau, which is a separate request again.

• The full claim file and internal claim notes
• Loss adjuster and investigator reports
• Underwriting and premium calculation records
• Medical evidence and reports obtained about you
• Records of a claim declined or a policy voided

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.