Subject Access Request to Equifax

The free statutory credit report is the answer for most people, and Equifax says so itself: "You have a right to find out what personal data Equifax holds about you and for a copy of this information to be provided to you free of charge. The most relevant information Equifax holds about you is likely to be contained in your own Statutory Credit Report." That report is free, and Equifax puts it plainly — "You are entitled to receive a free statutory credit report for life", "accessible for life and is updated daily, upon login". A posted copy arrives "as soon as possible but no longer than a calendar month". One catch worth knowing before you choose: "you are only able to receive a monthly Equifax Credit Score if you view your statutory credit report online". A full data subject access request is for everything the credit file is not, and it is a different door. On Equifax's subject access portal, the prominent "Access Your Personal Data" button sends you back to the statutory credit report product page; the actual request sits behind a second, quieter link for "personal data held and processed by Equifax that doesn't form part of your financial circumstances". Behind it you pick categories — marketing services data, motor finance data, business information, customer service and membership records including legal and compliance files, copies of written communication, and calls made to customer services — and Equifax says "depending on the categories of data requested, this may take between five days and one calendar month". The privacy notice puts the same thing as "it may take us up to one month to collate and provide you with this information". You can make the request by telephone, which is unusual and is published with hours: "If you'd prefer to make your request by telephone, one of our advisors will need to take your personal details and attempt to verify your identity during the call. Please allow up to 30 minutes to complete this process." The line is 0800 014 2955, free from UK landlines and mobiles, or 0333 321 4043, available 8am to 6pm Monday to Friday excluding 25 and 26 December. Motor finance data has its own route again — through the myEquifax app or a separate online journey — set up so you can identify the lender behind a car, motorbike or van agreement. It is also one of the categories you can pick inside a full request, so the two overlap. If you have worked at Equifax, or applied for a job there in the past twelve months, requests about employment or recruitment records go to a different mailbox, HR.EmployeeDSAR@equifax.com, and not through the portal. Equifax publishes no route for a request about someone who has died — "deceased", "probate" and "executor" appear nowhere on its privacy notices or its subject access pages — and rights of access end at death in any event. Asking about someone living needs their consent, or an appropriate power of attorney or court document. Equifax is one of three credit reference agencies and they hold different files. Experian is a separate controller with its own route, and TransUnion is a third; a lender reporting to one does not report to all, so an account missing from one file is often held by another agency rather than wrong. If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.