Banks and lenders
Subject Access Request to a Bank
Two things decide whether a request to your bank is worth making, and neither is obvious from the outside. The first is whether what you want is already free in online banking — for statements it usually is. The second is which company actually holds your records, because the name on your card is often not the name of the data controller, and a request sent to the wrong company in the group is a month lost. This page settles both before you send anything.
Find your bank, and what is specific to it
Each linked page carries that organisation’s own published route — the form or portal, the postal address, the ID they ask for — with the source it came from and the date it was checked.
Three companies share the name — Barclays
Barclays Bank UK PLC is the controller for personal banking, business banking and Barclaycard; Barclays Bank PLC is a different company with its own ICO registration covering the Private Bank, international banking and Stockbrokers, and some Wealth Management customers are told the controller is Barclays Investment Solutions Limited instead. The request form is the same one in every case, but the answer to “who holds my data” is not — the Barclays page also covers the statement windows that make a request unnecessary, and what to do if you want to know why an account was closed.
Halifax is a division of Bank of Scotland
Halifax’s own privacy notice says your information is held by Halifax, a division of Bank of Scotland plc, and the group’s team handles the request — so replies and paperwork may come back carrying Lloyds Banking Group’s name rather than the one on your card. The Halifax page has the online form, which covers credit cards, loans, mortgages and bank accounts, and explains which of the several published postal addresses is the one its own form points at.
Two Revolut companies, and your T&Cs say which
Revolut says the primary controller in the UK is either Revolut Bank UK Ltd or Revolut Ltd depending on which entity you onboarded to, and that you can check which by reading the terms that apply to your account. They are separately authorised and separately registered, but they share an address and a mailbox, so one email reaches the right team either way. The Revolut page also separates the in-app download Revolut calls a subject access request from the request itself, because they do not return the same thing.
RBS and NatWest are two separate requests
The Royal Bank of Scotland and National Westminster Bank are different legal persons, so a request to one is not a request to the other, even though they sit in the same group and use the same request platform. RBS maintains two subject access pages that each omit what the other carries, and its own privacy notice points at the one without the postal address — the RBS page puts both halves in one place.
Two NatWest pages that do not link to each other
NatWest publishes its subject access information twice: one page carries the postal address, the phone routes and how the answer comes back, the other carries the things worth reading before you send anything, and neither links to the other. The privacy notice points at the second, so a reader following it never sees the address. The NatWest page has both, plus the seven years of statements already sitting in Online Banking and the window you get to download the answer once it arrives.
Four published addresses for one request — Lloyds
Lloyds asks you to use its online form, and that is the route to take if you can. Across its own pages it prints four different postal addresses for the same request; the Lloyds page uses the one on the data privacy notice, which is the document the form itself tells you to post a printed copy to. It also covers the response clock and its extension, and the faster free route for statements — which is what most people asking Lloyds for “my information” actually want.
Cards, loans and savings are separate queues — MBNA
MBNA’s online form covers credit cards and loans and has a printable version, and more than one address is published for the same request — page one of the form itself, the privacy notice and the “Requesting your information” page do not agree. The MBNA page sets out which is which, and notes that either building should reach the team, so a letter already posted to Andover is not wasted.
No form, no email — the addressee line routes it at HSBC
HSBC UK publishes no online subject access request form and no email address for exercising your rights. The route is a letter, and because the postcode is a non-geographic one used for almost everything the bank receives — the Data Protection Officer and complaints included — it is the addressee line rather than the address that gets it to the right team. The HSBC page has the exact wording, and the other channels its privacy notice offers.
Five ways in, and one address that has moved — Santander
Santander takes requests through its online form, by post, by phone, in branch, or through chat in Online Banking, and publishes no email address for making one. Its own booklet still prints an earlier postal address alongside the current one. The Santander page has the address that is current, and the other trading names — including cahoot and Abbey — that sit under the same registration.
Three years of statements are already free — Nationwide
Nationwide’s own access form tells you three years of statement history are available in Online Banking at any time, which is what most people asking for their information want. A request is worth making for what is not a statement: call recordings, branch and chat notes, complaint files, and the reasoning recorded behind a lending or mortgage decision. The Nationwide page also flags that the online form covers the right of access only.
Declined applications and automated decisions — Capital One
Capital One shows a year of statements in your online account and will post older ones if you ask in the app, so a request is not the fastest route to those. It is the route to what the account screens do not show — call recordings, complaint files, fraud and affordability checks, and the reasoning behind a credit limit or a declined application, which Capital One says it decides by machine. The Capital One page covers how long a declined applicant has, and why asking a human to look again is a different right from asking for your data.
Records your bank does not hold
A fraud marker. These are usually not held by the bank alone, and a marker recorded with a fraud prevention service needs its own request sent directly to it — Cifas and National Hunter each have their own page here. Asking your bank alone will not show you what they hold.
Your credit file. Credit reference agency data sits with Experian, Equifax or TransUnion rather than with the lender. If what you want is the record behind a lending decision, that is the bank; if it is the file the decision was made against, that is the agency.
A decision reviewed, or money back. A subject access request gets you the records. It does not reopen a complaint or reverse a charge, and it is not a route to compensation — every one of the pages above sets out the separate complaints route and the ombudsman deadlines that go with it.
Statements you can already download. Most of the banks above publish several years of statements in online banking for nothing, and several say plainly that a subject access request is not the best way to get them. Check the page for your bank before you send anything — the window differs, and on some it closes when you close the account.
Making the request yourself, free
Every bank on this page accepts a request made directly, for free. Most publish an online form and ask you to use it, which is usually the fastest route and the one least likely to go astray. If you have not made a subject access request before, what a subject access request is covers the right itself — what it costs, how long they have, and what identification they can ask for — and our free letter template gives you wording you can send yourself. If an answer has already come back late or thin, the free response checker walks through what a complete response should contain.
Being specific helps more here than almost anywhere else. A request naming the account, the dates and the events you care about produces a far more useful answer than a blanket request for everything — and the pages above say what each bank holds that is worth naming.
Where this comes from
Every route on this page restates what the linked organisation page sets out in full, and each of those pages carries the organisation’s own published source and the date it was checked — follow the link and read it there rather than take a summary’s word for it. Banks reorganise and move addresses; tell us if something here is out of date.
Last checked 18 August 2026
If a subject access request is the right route
You can make one yourself, free, using the routes on the pages above. If you would rather not handle the wording, the sending and the chasing, GetMySAR prepares, sends and follows up your request for a fixed £20 fee.