Subject Access Request to Lloyds Bank

Lloyds asks you to use its online Data Subject Access Request form, and that is the route to take if you can. It publishes four different postal addresses for the same request across its own pages; the one here is the one on the data privacy notice, which is the document the form itself tells you to send a printed copy to. A request is free. Lloyds says it has one calendar month to respond, extendable to up to three where a request is complex — a high volume of data, several accounts or products, or an unspecified timeframe — and that it will tell you about any extension and why. Most people asking Lloyds for "my information" want statements, and there is a faster free route: internet banking holds your last five years, and a separate Copy Statement Team handles written requests for copies. A copy of your loan or credit card agreement is a different right again, under sections 77 and 78 of the Consumer Credit Act, with its own address. Records of someone who has died are not a subject access request — data protection rights end at death. Lloyds says its form "should not be used for deceased customers" and asks for a written request to its bereavement team instead. Lloyds publishes a data privacy line on 0345 602 1997, open 8am to 6pm seven days a week, but only for questions about a rights request: the sentence immediately after it says that to get a copy you fill in the form or write.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.