Subject Access Request to Cifas

Cifas does not charge for a data subject access request, and says it will never charge you to make one or to make a complaint. It also warns people to avoid third parties that claim to guarantee removal of a Cifas marker for a fee. GetMySAR does not offer marker removal and nobody can promise it. Cifas asks for the request online, through its own DSAR form. It asks that the applicant completes the form personally, and the request is only sent to Cifas once you have finished the identity verification step and been given a reference number. This is a request you will need to complete yourself. The phone number above is Cifas's DSAR advice line, open Tuesday and Thursday from 9.30am to 2pm. It is help with making the request, not a way of submitting one. The postal address above is the data protection officer address Cifas publishes in its website privacy notice, not a DSAR submission address. Cifas publishes no postal or email route for making the request itself. A written request is still valid in law, but the online form is the only route Cifas describes and the one it processes. Asking what Cifas holds and disputing it are two separate things. The DSAR gets you the data. If you then believe a marker is wrong, that is a separate complaint, and it may also involve the member organisation that recorded the marker rather than Cifas alone. Cifas is not a credit reference agency. Only victim markers - "Victim of Impersonation" and "Victim of Takeover" - appear on a credit report, and they stay on the Cifas databases for 13 months from the date they were filed. Other markers can be held for up to six years and do not show on a credit report, which is why people are often declined without being able to see why. Experian, Equifax and TransUnion hold separate files and need separate requests, and National Hunter is a different organisation again, as is the Claims and Underwriting Exchange, which the Motor Insurers' Bureau runs for motor, home and personal injury claims. Have ready your full name, date of birth, six years of address history, and your phone numbers and email addresses. If a company is being declined for products or services, Cifas asks each director to apply personally in their own details; sole traders do the same.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.