Subject Access Request to Experian

The free credit report is already a subject access request, and for most people it is the one they want. Experian says so on its own statutory report page: "Your application is made under Article 15, General Data Protection Regulation, 2018 and we will keep a record of your application." The Statutory Credit Report costs nothing, comes online or by post, and shows credit accounts, searches, the electoral roll, notices of correction, financial associates, public information such as CCJs, IVAs and bankruptcies, and rental information. Order it online and "the passkey will be posted to you within 5 working days". Experian's paid CreditExpert subscription is £14.99 a month and a basic Experian account is free; neither is necessary to see your file. A full data access request is for everything the credit report is not. Experian's own framing: "This is where you can ask for a copy of all the personal data Experian holds about you. For most people, the data they want from Experian is already available in their credit report." The nineteen categories it then lists include Experian marketing services, Affordability, Open Banking services for account holders including Experian Boost, Background checking (which covers candidate application information used for employer screening and tenant application information used by landlords and letting agents), Web monitoring, Historic credit reports, Comparison services, Experian Automotive, Tracing credit accounts, Identity checks and fraud detection, and Contacting us — call notes, complaint files and data queries. If your reason for asking is a failed tenant reference, a job screening result or an affordability decision, that is the request you want, not the credit report. Experian only answers for you. "Experian can only provide a copy of your own credit report. Other people (including your partner, spouse or anyone else you may have applied for credit with) must each apply for their own report." A financial association shows on your file, but your associate's data is theirs to ask for. No response time is published. Nothing on the data access page, the rights page, the statutory report page or the third-party page states a deadline for a data access request — the only timescales published are five working days for a passkey and about seven for a posted statutory report, both of which are the credit report route rather than this one. The one month you are entitled to comes from the law. Two mailboxes on these pages are not access routes, and one of them looks like it. customerservices@uk.experian.com appears only under "How to opt out with Experian" and is the marketing suppression address. Employees and former employees are told to write to one address on the data access page and a different one on the very next page of the same flow, so if you are asking about your own employment records expect to be redirected once. A request about someone who has died is not a subject access request — rights of access end at death — and Experian handles a deceased person's file through a grant of probate route on its third party page instead. That page also covers power of attorney. Experian is one of three credit reference agencies and they hold different files. Equifax is a separate controller with its own request route, and TransUnion is a third. Lenders report to some and not others, so a missing account is often a different agency rather than an error. If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.