Subject Access Request to National Hunter

National Hunter is a database of financial application data run by N Hunter Ltd, a not-for-profit membership organisation owned by the lenders that use it. N Hunter Ltd says it acts as a processor of the data held in National Hunter on behalf of those members, who are the controllers, although the ICO register lists N Hunter Ltd itself as a data controller. The practical consequence is the same either way: it can show you what is held, and only the member that submitted an entry can change or remove it. It answers requests itself. Complete its Subject Access Request Form and email it with your identification to info@nhunter.co.uk, and it says it will cooperate with the relevant member so that your request is actioned and answered. The address above is the organisation's registered contact point, published on its complaints policy and on the ICO register; National Hunter publishes no postal address for the request itself and no telephone number anywhere. The answer comes back by email only, as a password-protected PDF sent from a no-reply mailbox, and National Hunter asks you to check your spam and junk folders for it. By giving an email address you accept responsibility for delivery, and it says it cannot be responsible for third-party access to a shared address. Whatever you send with your request is securely destroyed 50 days after its response. The form asks for six years of previous surnames, addresses, telephone numbers and email addresses, so that is the span to give. How long the data itself stays on the system is not published as a number: National Hunter says it depends on the contractual terms with each member and on that member's own retention periods. It is not a credit reference agency and it is not Cifas. It says it holds no credit scoring records, no credit histories, no County Court Judgments and no electoral roll information, and no details of PPI, PCP or hire purchase policies or payments. Your credit file is a separate request to Experian or Equifax, and a fraud marker recorded with Cifas is a separate request to Cifas. Its published members list names banks, building societies, card issuers and motor and asset finance companies and no insurers, so an insurance claims record is more likely to sit with the Claims and Underwriting Exchange, which the Motor Insurers' Bureau runs. Being on it proves nothing, and so does not being on it. National Hunter says that being directed to it after an unsuccessful application does not necessarily mean its data contributed to that decision, and that finding no data for you may just mean the organisation you applied to does not submit data, or that you have not applied for credit in the past 12 months. If you think an entry is wrong, National Hunter cannot fix it. It says requests to remove or erase data, or to object to a fraud-related decision or status applied by your lender, have to go to the organisation that submitted the data, and that it can help you identify which one that is if you do not know. It will correct a verifiable factual error in what it processes, such as a date of birth entered wrongly. A complaint to National Hunter itself is acknowledged within 5 working days and answered within 20. Members may make decisions about this data by automated means, and National Hunter says that questions about an automated decision go to the member directly. It also says a record of a fraud or money laundering risk is retained and may result in others refusing to provide services, financing or employment. Nothing on its site says the request is free, and the form reserves the right to charge a reasonable fee or to refuse a request it considers manifestly unfounded, excessive or repetitive. It publishes nothing at all about a person who has died — and data protection rights end at death, so a subject access request is not the route for someone else's records.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.