Subject Access Request to the Financial Ombudsman Service

Complaining to the ombudsman is free, and it is a different thing from asking the ombudsman for your data. If a financial business has given you a final response you are unhappy with, or has had eight weeks without giving you one, you can bring the complaint to the Financial Ombudsman Service at no charge. It says you do not need to pay anyone to represent you, including a lawyer or a claims management company, and that you can ask a family member, friend or someone else to help. You have six months from the date on the final response. For a complaint about fraud, a scam, a payment service or electronic money the business has 15 days rather than eight weeks. A subject access request is neither a complaint nor an appeal: it gets you records, and it does not get a decision reviewed. What a request gets you is the ombudsman's own file about you. It says you can ask for any personal data it holds or stores about you, including on your complaint file, copies of personal data held in correspondence or call recordings, and details of how it uses and stores your data. It also says plainly what you cannot have: a full copy of your complaint file or the file the financial business submitted, full copies of documents that are not your personal data, and information about other people. The business's own records are a separate request to the business — start from the directory of organisations, or the banks and lenders hub if that is who you complained about. Before you make a formal request, the ombudsman asks you to speak to your case handler. It says they may be able to give you what you want — specific documents or evidence used in your case — more quickly, and that if so you will not have to make a subject access request at all. It says separately that it will not share the full complaint file with either side, but that it is happy to share the information it relied on to assess your complaint without a formal request. You can ask while the case is still open. If you do need to make the request, the route is email to the Information Rights team at the address above, and there is no form and no portal. On the ombudsman's own subject access page that address is hidden behind the words "contact our Information Rights team", so it is not visible in the text of the page; it is written out in the contact block of its privacy notice, which also carries the postal address. Two links on that subject access page are broken — one labelled "Our privacy policy" returns a not-found page because of a stray character in its address — so reach the privacy notice from the site footer instead. Say exactly what you are looking for: the ombudsman says the more specific you are, the quicker it can give you the right information. A request is valid however you make it, and a letter covering the same details is enough. No deadline is published for a consumer. The ombudsman's subject access page states no time limit for answering at all, and the only place it commits to one is its job applicant privacy notice, which says one calendar month with an extension where a request is complex. It says it will not usually charge. For comparison, it does publish a deadline for a freedom of information request, of 20 working days. Expect part of it to be held back, and the ombudsman says which parts. It may refuse a request it considers clearly unfounded or excessive, and its examples include one that matters here: a repeat request for personal data on a complaint file where no new personal data has been added. It may withhold legally privileged material such as advice from its own legal team, and anything it thinks would prejudice the proper discharge of its statutory function — its words for the ability to resolve complaints quickly and informally. It may remove other people's names and contact details; it says it will name the business it contacted about your complaint, but not necessarily its contact there. The terms and conditions of an account or policy, and a business's call scripts, are not your personal data and are not included. There are three different places to go if you are unhappy, and the ombudsman keeps them apart. The outcome of your case is not one of them: there is no appeal from an ombudsman's final decision. Poor service goes to your case handler, then to a manager who acknowledges within two working days and answers within 15 working days, and then to the Independent Assessor, who reviews the service but cannot review the outcome, must be asked within one month of the case closing, takes up to six weeks and whose review cannot be appealed. How your data was handled, including how a subject access request was answered, goes to the Information Rights team and then to the Information Commissioner's Office. The Independent Assessor says in terms that she cannot look at how the service handled your personal information, and points those complaints back to the Information Rights team. It keeps your case file for six years after the case closes, or three years if it did not go on to fully investigate it or transferred it to another organisation. An enquiry that never became a complaint is three years. Ombudsman final determinations are kept permanently. Paper you send by post is scanned and destroyed six months later, and original documents such as a birth or death certificate are returned to you. Two things the ombudsman publishes nothing about. It says nothing about a subject access request made by a representative or a claims management company on someone else's behalf — its published position on acting for someone else is about bringing a complaint, not about asking for data. And it says nothing about the records of a person who has died. Data protection rights end at death, so a subject access request is not the route for another person's records, although the ombudsman does say it can consider a complaint brought on behalf of someone who has died or who lacks mental capacity, where you are authorised by UK law to bring it. Do not use a freedom of information request for this. The ombudsman says you cannot ask for information about yourself under the Freedom of Information Act and should make a subject access request instead, and its own quarterly figures show it refusing requests on that ground every quarter and then handling them under data protection law anyway. Both requests go to the same mailbox.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.