Subject Access Request to Companies House

A subject access request to Companies House will not remove your home address, or anything else, from the public register. Companies House relies on an exemption in paragraph 5 of Part 1 of Schedule 2 to the Data Protection Act 2018, which disapplies the requirement to provide personal data in response to a subject access request, the requirement to rectify it, and the requirement to comply with a request to be forgotten, for the information the Companies Act 2006 obliges it to publish. Removing a home address, a signature, a business occupation or the day of a date of birth from a document already on the register is a separate application on form SR01, and it costs £34 for each document you want changed. You pay through GOV.UK Pay first, then email the form and the payment reference to dsr@companieshouse.gov.uk, or post it to The Registrar of Companies, PO Box 4082, Cardiff, CF14 3WE. Companies House says it has no legal power to remove an address that is the subject of a mortgage charge, one that forms part of a company's name, or a current registered office address - that one has to be changed first. Full guidance: removing your personal details from the Companies House register. Keeping a home address from credit reference agencies, or protecting all your details as a person with significant control, is a further separate application under sections 243, 790ZF and 1088 of the Companies Act 2006. It costs £100, or £15 if your home address is already protected, and it is open only where you or someone living with you is at serious risk of violence or intimidation because of the company's activities. Companies House says these take at least 30 days and complex applications up to a year. Its secure registers team answers questions about both routes on dsr@companieshouse.gov.uk and 02921 507370, Monday to Friday, 9am to 5pm. Full guidance: applying to protect your details on the Companies House register. A subject access request does still reach what Companies House holds away from the register: correspondence about a complaint or enquiry, which it keeps for 10 years; call recordings, kept for 18 months; the account details behind WebFiling and its other web services; the supporting information you gave to verify your identity, which Companies House says does not form part of the public register; and an application to register as an authorised agent. Its privacy notice says that if you want to exercise any of these rights you can contact the DPO at dpo@companieshouse.gov.uk, and that it handles every such request case by case. Send complaints about how Companies House has handled your data to dataprotectioncomplaints@companieshouse.gov.uk instead - that address is for complaints, not for making the request. The postal address above is the Companies House main office, which is the address it publishes for general post and the one on its entry in the ICO's register of fee payers. Companies House publishes no separate postal address for data protection requests, and no response time for one. Companies House is an executive agency of the Department for Business and Trade. Its privacy notice names the registrar as the controller of your personal data, and says the controller may be the department instead in certain circumstances - for example where an individual or company is being investigated for a criminal offence. HM Land Registry works the same way for property records: another public register whose contents are outside subject access, with its own separate route. If you are not sure which department holds what you need, start from which department holds the record you want.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.