Subject Access Request to MBNA

MBNA asks you to use its online Data Subject Access Request form, and that is the route to take if you can — it covers credit cards and loans, and there is a printable version if you would rather post it. MBNA publishes more than one postal address for the same request. The one here is printed on page one of its own DSAR form, which is the document you post, and is the same building its privacy notice gives; its Requesting your information page instead says to post the form to MBNA Ltd DSAR, Charlton Place (C42), Andover, Hampshire, with no postcode, and the online form gives Data Subject Access Request Team (C41), Charlton Place, Charlton Road, Andover, Hants, SP10 1RE. Either building should reach the team, so a letter already sent to Andover is not wasted. Your information is held by MBNA Limited, which MBNA's privacy notice calls the legal entity that holds it, and which is part of Lloyds Banking Group — so replies and paperwork may carry Lloyds Banking Group's name, and the registration number here is MBNA Limited's own rather than a parent company's. Credit cards are issued by MBNA Limited. For a personal loan MBNA says it is a credit broker and not the lender, that it works exclusively with Lloyds Bank plc, and that MBNA is a trading style of Lloyds Bank plc, so a request about a loan may be answered by Lloyds Bank. A request is free. MBNA says Lloyds Banking Group has up to one calendar month from receipt to respond, extendable to up to three calendar months where a request is complex — a high volume of data, multiple accounts or products, or an unspecified or extensive timeframe — and that you will be told about any extension and the reasons for it. The help section on its online form instead says it aims to complete most requests within 5 to 7 working days. Most of what MBNA holds is visible without a request: it says you can view most of the information it holds through Online Services or the MBNA Mobile App, and that for copies of statements, details about an application or savings information it is best to call. A separate Copy Statement Team handles written requests for statement copies. A copy of your credit card or loan agreement is a different right again, under sections 77 and 78 of the Consumer Credit Act, with its own address. A closed account is usually not a deleted one, but an old one may be gone. MBNA says it keeps personal information for as long as you have a product or use a service and, in most situations, for up to 7 years after, keeping it longer only where it is archived for historical purposes or cannot be deleted for legal, regulatory or technical reasons. Its own form warns that it may not hold the data for the whole of a date range you ask for, so a request about a card closed many years ago may return little. The form is built for the reasons people actually ask: it lets you say you are looking for information about PPI, about a complaint, or about fraud on your account, and lets you ask for statements, charges, a complaint file, debt management records or application agreements over a date range you choose. An MBNA savings account uses a different route. There is a separate savings DSAR form posted to MBNA Savings at BX1 1LT, and the online form covers credit cards and loans only. Records of someone who has died are not a subject access request — data protection rights end at death. MBNA says its form should not be used for deceased customers and asks for a written request to its bereavement team in Manchester instead; its savings form gives a Leeds address for the same team. MBNA publishes 03456 062 062 (+44 1244 659 005 from outside the UK, 8am to 6pm seven days a week, closed on bank holidays) to speak to it about one of your data privacy rights — but the next sentence on the same page says that to get a copy you fill in the form or write.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.