Subject Access Request to Barclays

Barclays Bank UK PLC, ICO registration ZA261163, is the controller for personal banking, business banking and Barclaycard. Barclays Bank PLC is a different company with its own registration, Z5813704, covering Barclays Private Bank, overseas and international banking and Barclays Stockbrokers, and for some Wealth Management customers Barclays names Barclays Investment Solutions Limited as the controller instead. The request form is the same one in each case, but the answer to "who holds my data" is not. Most of what people want here is already free. Barclays publishes online statements for up to 7 years while the account is open, and for up to 5 years after you close an account if you still bank with Barclays. If you have left Barclays altogether neither window applies, and a subject access request is the route. Barclays also says that if you want to know why it closed your account, the quickest answer is its general number, 03457 345 345 — that line is a customer service number, not a way of making a subject access request. Barclays publishes no email address for making a customer request. DPO@barclays.com appears in its privacy notice and in the ICO register as the way to contact the Data Protection Officer, but the notice sends anyone who wants to exercise their rights to Online Banking or to its "control your data" page instead, so it is not recorded above as a submission route. The postal address above is the one Barclays gives on its own request form for people applying in writing under someone else's authority; it publishes no separate postal address for a first-person request, because the online form is the route it describes. A request made in writing is valid however an organisation prefers to receive it. Barclays' privacy notice separately gives the Data Protection Officer, Barclays Bank UK PLC, Leicester LE87 2BB — the same Leicester postcode. If you are applying on behalf of someone else, Barclays asks you to print the form and post it with a letter of authority rather than submit it online, and says it may contact the customer directly. If you worked for Barclays or applied for a job there and want records about that, Barclays asks you to email SubjectAccessRequestsHROperations@barclayscorp.com rather than use the customer form. Barclays owns Tesco Bank but says it does not include Tesco Bank data in what it sends you. A Tesco Bank customer has to make a separate request to Tesco Bank. Barclays says a request usually takes up to 30 days once it has been approved, and up to 90 days if it is complex. Those are its own figures, not the legal deadline, which is set out below. A request about someone who has died is not a subject access request — data protection rights end at death. A deceased customer's accounts are dealt with through Barclays' bereavement process and the estate.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.