Subject Access Request to Lowell

Two companies own and run your account, and Lowell says both are responsible for your data: "Lowell Portfolio I Ltd buys your debt and Lowell Financial Ltd manages your debt on behalf of Lowell Portfolio I Ltd", and "We are joint controllers of your information." You only need to make one request. Lowell's Privacy Team handles requests for every UK company in the group, and its response covers Lowell Portfolio I Ltd, Lowell Financial Ltd and Overdales Legal Limited — the group's law firm, which took over from Lowell Solicitors when that firm stopped practising on 31 March 2024. Say which companies and accounts you want included. Overdales publishes its own route at dpo@overdaleslegal.co.uk if you would rather ask it directly. The registration number above is Lowell Financial Ltd's; Lowell Portfolio I Ltd's is Z8222569. Asking for a copy of your credit agreement is a different request, and a subject access request will not produce one. That request is made under sections 77 and 78 of the Consumer Credit Act 1974, costs £1, is due in 12 working days, and applies only to a regulated credit agreement — not to a mobile phone contract, a former current account or a utility bill. Lowell publishes no route for making one, so use the contact details above. It does publish two things worth knowing first. A reconstituted or "true copy" is allowed and "doesn't need to include: a signature box, a signature, the date of signature from your original agreement". And if the agreement cannot be produced at all, the debt does not disappear — in Lowell's own words, "it does not mean that the debt is not owed, only that it is not enforceable in court until the agreement can be provided". What Lowell holds is the original creditor's file as it was handed over at sale, plus everything since: an "originating creditor information" section, statements or a transaction history from the original creditor, letters it sent you, and its own account, payment, income-and-expenditure, call, dispute and complaint records. Ask for specific dates and events rather than everything. Four things sit outside it — the deed of assignment or debt sale agreement, which "does not contain any details about you or your debt"; the price Lowell paid; other people's information; and anything the law lets it withhold, "for example, where there are ongoing court proceedings". Copies of letters may be template versions, and whatever the original creditor never handed over is still theirs to ask for: Lowell publishes a page for each company it buys from, including Vodafone, O2 and Capital One. If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing. If your reason for asking is that the debt is not yours, is already paid, or is too old, Lowell publishes faster routes. Tell it the debt is disputed and it says it will investigate and "won't ask you to make any payments during this time". If you think the debt is statute-barred — six years with no payment or acknowledgement in England, Wales and Northern Ireland, five in Scotland, where a prescribed debt stops existing rather than merely becoming unenforceable — Lowell asks you to call 0333 556 5552 "so we can check for you". Its assignment-of-debt page answers the "prove it" arguments point by point, citing section 136 of the Law of Property Act 1925 and Promontoria (Oak) v Emanuel [2021] EWCA Civ 1682. A request about someone who has died is not a subject access request, because the right of access ends at death, and Lowell publishes no separate process — no death certificate, no grant of probate, no form. It says only that if "someone you love has died and they had debts with Lowell", you should "get in touch and we can explain everything about your loved one's account". An executor or administrator should use the general contact route rather than this one. Lowell says a request can be made by phone, but the word "phone" links its general contact page rather than a data protection number, so the line you would reach is 0333 556 5552, open 9am to 6:30pm Monday to Friday and 9am to 4pm on Saturday. Its general contact form promises a reply "within six working days", which is a service promise and not the legal deadline. Information Lowell does not erase is kept for "no more than seven years after the date your accounts with us are closed", and a closed account stays visible in your online account for six months only, so ask sooner rather than later. Getting the records and getting something put right are separate steps. Complain first: Lowell aims to send a final response within four weeks and must write by eight weeks with the ombudsman details. Which ombudsman depends on what the debt was for — the Financial Ombudsman Service for credit, with six months to refer, but the Dispute Resolution Ombudsman for non-financial products such as energy, landline and mobile, with twelve months. One caution on the address: Lowell's complaints page gives its Customer Relations Team as PO Box 13079, Harlow, CM20 7TE, and that postcode does not exist. Everywhere else on Lowell's site, including every privacy notice, the same PO Box is CM20 9TE.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.