Subject Access Request to Halifax

Halifax asks you to use its online Data Subject Access Request form, and that is the route to take if you can - it covers credit cards, loans, mortgages and bank accounts, and there is a printable version if you would rather post it. Halifax's pages give more than one postal address for the same request; the one here is the one on its data privacy notice, which is the document the online form itself tells you to send a printed copy to. Halifax is a division of Bank of Scotland plc and part of Lloyds Banking Group - its privacy notice says your personal information "will be held by Halifax, a division of Bank of Scotland Plc". The group's DSAR team handles the request, so replies and paperwork may carry Lloyds Banking Group's name, and the registration number here is Bank of Scotland plc's, of which Halifax is a registered trading name. A request about a Lloyds Bank account is a separate request to a separate data controller. A request is free. Halifax says you will get a response in one calendar month, extendable to up to three where a request is complex - a high volume of data, multiple accounts or products, or an unspecified or extensive timeframe - and that you will be told about any extension and the reasons for it. Its form says the response goes to the correspondence address registered on your account. Most of what Halifax holds is visible without a request: it says you can view most of the information through the app or Online Banking, and Online Banking customers can access their last five years of bank statements by signing in. A separate Copy Statement Team handles written requests for copies. A closed account is usually not a deleted one: Halifax's privacy notice says it keeps personal information for as long as you have a product or use a service and, in most situations, for up to 7 years after that, so a subject access request can still reach records of an account you have closed. A copy of your loan or credit card agreement is a different right again, under sections 77 and 78 of the Consumer Credit Act, with its own addresses. Records of someone who has died are not a subject access request - data protection rights end at death. Halifax's form says it should not be used for deceased customers; send a written request to its bereavement team instead. Halifax publishes 0345 720 3040 (+44 113 242 1984 from outside the UK, 8am to 6pm, seven days a week, closed on bank holidays) for questions about how it uses your personal information or to talk about a data privacy rights request - but to get a copy, its pages say to fill in the form or write.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.