Subject Access Request to HSBC UK

HSBC UK publishes no online subject access request form and no email address for exercising your rights. The route is a letter, and the addressee line is what routes it: "Attention of Rights of Individuals Fulfilment (ROIF), Customer Service Centre, BX8 1HB", from section 12 of its full Privacy Notice, effective January 2026. The same section says you can also exercise your rights through chat in the mobile app, by chat on the website, in branch, or "by phone" — for which it gives no number. BX8 1HB is HSBC's own non-geographic postcode, and it is the address for almost everything. The Data Protection Officer sits at the same address marked "for the attention of the DPO", and complaints go to the same "Customer Service Centre, BX8 1HB" with no addressee line at all. The ROIF line is the only thing separating a rights request from a complaint, so put it on the envelope and at the top of the letter. If you would rather not draft one from scratch, our free SAR letter generator produces one you can print and post. HSBC publishes no response time and no statement about cost for a rights request. Section 11 of the full Privacy Notice lists the rights in a table with no deadline, no fee and no identity requirement, and the phrase "subject access request" does not appear in it at all. The one calendar month and the no-fee rule are the law rather than an HSBC promise. HSBC also publishes no guidance on what identification it asks for with a rights request, so expect to be asked and expect the clock to pause while you answer — how the time limits and ID rules work. first direct is a division of HSBC UK Bank plc and uses exactly the same route. Its app privacy notice gives "Customer Service Centre, BX8 1HB and addressed 'for Rights of Individuals Fulfilment (ROIF)'". M&S Bank is also a division of HSBC UK Bank plc, but it publishes different addresses: M&S Bank, PO Box 325, Wymondham, NR18 8GW, or M&S Bank, Kings Meadow, Chester, CH99 9FB, addressed "For the attention of Rights of Individuals Fulfilment (ROIF)". Its notice reaches the Data Protection Officer through that same ROIF line rather than separating the two, so there is no second addressee to choose between. Source: M&S Bank's privacy notices. Business customers are told two different things and both are current HSBC documents. The Business Banking app privacy notice gives "DPO (HBUK CMB), HSBC UK Bank plc, Customer Service Centre, BX8 1HB" for the attention of ROIF. The Privacy Notice for UK business customers, linked from HSBC's business legal information page and last updated in November 2023, instead gives PO Box 760, Fareham, PO14 9TE and does not mention BX8 1HB anywhere. If your request is about a business account, send it to both. Not every HSBC is this HSBC. HSBC UK Bank plc, ICO registration ZA276331, is the ring-fenced UK bank, and it covers personal banking, first direct, M&S Bank and UK business banking. HSBC Bank plc (ZA registration Z5734875, 8 Canada Square, London) and HSBC Innovation Bank Limited (ZB350765, Finsbury Square, London) are separately registered controllers in their own right, and HSBC Private Bank publishes separate notices for several further entities. If your account sits with one of those, the address above is not the right one. Six years of statements are already inside the HSBC UK app and online banking — HSBC's own statements guidance says "You can view old statements dating back 6 years". So the request is worth making for what statements do not show, rather than for the statements themselves. HSBC says it normally keeps main banking information for seven years from when its relationship with you ends, so closing an account does not empty the file, and a request reaches roughly a year further back than the app does. HSBC names six fraud prevention agencies it shares data with: Cifas, National Hunter, Synectics Solutions, BioCatch, LexisNexis (ThreatMetrix) and Mastercard (Vocalink). A marker recorded with any of them is that organisation's record and not HSBC's, and Cifas has its own free request route. HSBC's complaints process never mentions data protection or the Information Commissioner, and escalates only to the Financial Ombudsman Service. The Ombudsman does not police the right of access, so a missed deadline or a thin response is an ICO matter rather than an Ombudsman one. It is worth checking the response against what you were entitled to before you decide which it is. A request about someone who has died is not a subject access request, because data protection rights end at death. HSBC's bereavement route is 0800 085 1992, or HSBC Bereavement Services, Abbey View, Penfold Drive, Wymondham, NR18 0WZ. Once HSBC has the death certificate and knows you are the legal next of kin or executor, it will give you the account balances by phone or by post; once it has separately verified your identity and address, its Bereavement Support Team can provide a list of the standing orders and Direct Debits on the accounts.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.