Subject Access Request to MIB

MIB is the Motor Insurers' Bureau, and one request reaches all of it. MIB is the data controller for the databases it runs, and its privacy policy says so: "MIB is the data controller for the personal information we process, unless we state otherwise." Insurers are subscribers who supply the data and enquire against it; they do not hold it. So a single data subject access request to MIB covers the Claims and Underwriting Exchange (CUE), Motor Insurance Policy Data on Navigate, the Vehicle Salvage and Theft Data that used to be called MIAFTR, the askCUE PI database solicitors search, the Police Helpline record of stops and seizures, and MIB's own file if you have claimed against an uninsured or untraced driver. There is no separate route for CUE, no separate route for askMID and no separate route for MIAFTR. MIB publishes one email, one postal address, one phone option and one online form for all of them, and its own page lists every database under that single request. MIAFTR no longer exists as a name — MIB says Navigate "is the home for data from the former Motor Insurance Anti-Fraud & Theft Register (MIAFTR)" and that "the term MIAFTR is now retired". The support mailboxes MIB lists for askMID, CUE and MIB Services under "Professional services support" are help desks for subscribing organisations, not routes for your own data. The retention windows decide whether the request is worth making, and MIB publishes them per database: Motor Insurance Policy Data seven years, CUE six years from the date a claim or notification is closed, MIB's own claims file six years from the date a claim is closed, Vehicle Salvage and Theft Data seven years, the askCUE PI database three years, Navigate enquiries three years, the Police Helpline two years, and the uninsured-vehicle data MIB holds with the DVLA two years and one month. MIB also says it cannot share vehicle markers from before you owned the vehicle. If all you want to know is whether a vehicle is insured, you do not need a request. MIB's Check Your Vehicle service is free and instant and reads the same Navigate record. It tells you only whether there is a live policy: "If you want further information about your policy, you'll need to contact your insurer or review your policy documents." If the record is wrong, the request is not the fix. Insurers supply the data, and MIB sends you to yours: "If you believe this is incorrect, contact your insurer", and, on a vehicle registration that does not match your policy, "Contact your insurer if you notice any inaccuracies." MIB will accept a rectification request at the same address it takes access requests, but the correction has to come from the insurer that filed the entry. This is the shape of a Cifas marker — the database operator holds it, the member owns it. MIB is not covered by an ombudsman. It says in terms: "As an independent body, we are not governed by any other Ombudsman or Conduct Authority." So the Financial Ombudsman Service, which would take a complaint about an insurer, has no role here. A complaint about how MIB handled your request goes to MIB and then to the Information Commissioner's Office; MIB aims to give a detailed response within ten working days wherever possible, and a final response within eight weeks of acknowledging the complaint if it takes longer than that. A complaint about a claim MIB has handled under the Untraced and Uninsured Drivers' Agreements goes, once MIB's own procedure is exhausted, to the Minister for Transport, who is responsible for the running of the Agreements but not for individual cases. MIB will not look at a complaint about your insurer: "MIB has no remit to consider complaints about the conduct of insurance companies or in relation to any services that are not managed by MIB." Your insurer's own claim file is a separate request to that insurer, and it will hold far more than MIB does — the claim notes, the loss adjuster's report and any medical evidence. Expect an identity check, and expect it to be an outside one. MIB says "You'll need proof of identity for all requests", and its online form verifies identity through Experian. The form also sends a verification code to the email address you give, and it leaves mib.org.uk for a service-now.com address partway through, which is worth knowing before you upload a passport. If you would rather not use the form, the email, postal and phone routes above take the same request. A request about someone who has died is not a subject access request — data protection rights end at death — but MIB publishes a route for it: "If you would like to request data about a deceased person, please send an email to dsar@mib.org.uk detailing the information you need." Send that one yourself. It is free and it is the only route MIB publishes for it. The email address on the ICO's public register is not the one to use. The register entry for Z5530300, and MIB's own privacy policy, both give privacy@mib.org.uk as the Data Protection Officer's address. The address MIB names on its request page is dsar@mib.org.uk, and that is the one above. MIB also runs several sister organisations with their own ICO registrations — the Insurance Fraud Bureau, the Employers Liability Tracing Office, Claims Portal, Official Injury Claim and the Motor Insurers' Information Centre — which are covered by the same privacy policy but are separate legal entities. Two things MIB does not hold. Your driving record, penalty points and vehicle keeper details are the DVLA's, not MIB's. And the police record of a stop or a seizure sits with the force that made it — MIB's Police Helpline entry is only MIB's side of that enquiry, so if you want the incident record you need the force as well.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.