Subject Access Request to Capital One

Capital One shows a year of statements free in your online account, and will post older ones if you ask: "You can view and download statements from the last year in the 'Statements' area of your online account. If you'd like a copy of a statement from a previous month, start a chat with us in the app. Just tell us what you need and we'll post a copy to you." If an old statement is all you want, the app chat is faster than a subject access request and costs nothing. A subject access request is for the records the account screens do not show: call recordings, complaint files, fraud and affordability checks, and the reasoning behind a credit limit or a declined application. Capital One decides both of those by machine — "we use automated decision making when deciding whether to lend money to you and to determine the initial setup for our products (e.g. what credit limit you will be offered on your credit card)" — and its own pages confirm calls are kept, with the line "Calls may be recorded/monitored for training purposes". Ask within 18 months if your application was turned down. Where an application is declined or you do not proceed, Capital One keeps the data "for up to 18 months after your application or quotation search was made", against up to seven years after a relationship ends. A request made later may find nothing left to send. If you want the decision changed rather than the data, that is a different right on the same contact details. Capital One publishes a right to manual review: "you can request for us to: (i) reconsider the decision; or (ii) take a new decision that is not based solely on automated decision making and ask that a person review it." Capital One publishes two postal addresses for a subject access request and reconciles them nowhere. This page carries the one in its privacy policy, which is dated 11 June 2026 and repeats it three times. Its own subject access request page gives a different one, "Subject Access Request, Capital One (Europe) PLC, PO BOX 5281, Nottingham, NG2 3HX", and carries no date at all. Either should reach the right team, so a letter already sent to Nottingham is not wasted — but check the PO Box number before you post, because complaints go to PO Box 4928 and subject access requests to PO Box 4929 at the same postcode, so a single digit decides which team opens the letter. The telephone route is real, and the line is not a specialist one. Capital One says a request can be made "in writing, over the phone or you can submit a request using your online account via secure message", and prints 03444 812 812 — which its privacy policy calls "our general account queries line". Through a textphone or the Relay UK app the number is 18001 0344 481 8852. Two different response times are published. The privacy policy says Capital One tries to respond "within one month" and may take longer "if your request is particularly complex or you have made a number of requests"; the subject access page says only "Once we have the right information, we will answer your request within a month", which starts the clock when Capital One is satisfied it has enough from you. The month you are entitled to comes from the law, not from either sentence. What Capital One reported about you sits on your credit file, and that is somebody else's request. Its privacy policy names the three agencies it uses and links each one: TransUnion, Equifax and Experian. A Capital One search showing on your file is agency data, and Capital One explains that a quotation search "is also known as a 'soft search'. Only you and the credit reference agency can see the 'soft search'. It'll disappear after 12 months." Checking eligibility with QuickCheck, or through a comparison site, is usually what put it there; applying leaves a hard search instead. Cards sold under other brands are the same controller and the same route. Capital One publishes brand copies of this privacy policy for Luma, Ocean, ThinkMoney, Post Office and ASOS cards, and every one of them names Capital One (Europe) plc as the controller with identical contact details. Staff and former staff have a separate route and should not use the customer one: email AskHREurope@capitalone.com with the subject header "Data Protection", or call 0115 843 6100. Capital One publishes no process for a third party making a request on your behalf. Its third-party access pages cover running an account — authorised user, nominated support, power of attorney — and not asking for data, so a representative's request goes by post or email with written authority, with no published identity checklist to work to. A request about someone who has died is not a subject access request, because rights of access end at death. Capital One handles a bereavement through its own bereavement page or on 0344 481 5819, and its bereavement partner Phillips & Cohen Associates then makes contact within 30 days. If you would rather do it yourself, our free letter tool will write the request, and our free response checker will show you what a complete answer should contain.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.