Subject Access Request to Nationwide Building Society

Three years of statement history are already free in Online Banking, so most people asking Nationwide for their information do not need a request at all. Nationwide's own access form says you can get three years of statement history through Online Banking at any time by logging in, selecting statements, and saving or printing. A request is worth making for what is not a statement: call recordings, branch and chat notes, complaint files, fraud and affordability assessments, and the reasoning recorded behind a lending or mortgage decision. A fraud marker is usually not held by Nationwide alone, and a marker recorded with Cifas needs its own request sent directly to them. The online form covers the right of access only. Nationwide says "This form will let you request a copy of your personal information only, no other Information Right requests will be progressed", and runs a separate shared form for rectification, erasure, restriction, objection, human intervention and withdrawal of consent. Someone who wants a record corrected or deleted and files an access request has used the wrong form and will be told so after the clock has run. Nationwide's response wording is inconsistent on its own page, and the shorter figure is not the legal deadline. Its right-of-access section says it will "get back to you within 30 days"; the same page's summary of what happens next says it will "provide you with a full response to your request within one month, by post or email". One month is the statutory period and is longer than 30 days in most months, so it is worth knowing what the one-month deadline actually requires before chasing, and what to do if Nationwide misses the deadline. Leaving the date range blank asks for everything Nationwide holds. The form says "If you leave this blank, we will send all the information we hold. Please note, this could lead you to receiving a large amount of information." Naming the years and the product you care about is usually faster. Nationwide publishes no email address for a member's request, and the address on the ICO register is not one it offers. The register lists data.privacy@nationwide.co.uk as the contact for its Data Protection Officer; Nationwide's own pages ask you to use the online form, the post or the phone, and its published DPO route is a different address again — The Data Protection Officer, Nationwide Building Society, Nationwide House, Pipers Way, Swindon, SN38 1NW. The DPO handles questions about how Nationwide uses information rather than answering requests. If you would rather post a letter than use the form, you can write to them yourself for free. Virgin Money and Clydesdale requests go to a different team, so a member with both a Nationwide and a Virgin Money account has to make two requests. Virgin Money's own privacy notice says "If you have an account with Nationwide, you'll also need to submit a request to them", and gives its route as emailing DSARCCA.Queries@cybg.com or writing to the Rights Request Team, Virgin Money, Sunderland SR43 4JB. Nationwide says the same from its side. A request about someone who has died is not a subject access request and Nationwide will refuse it. Its access form says "We are not able to provide an Access Request for a deceased person. You can contact our Bereavement Team by going into branch." Data protection rights end at death, and Nationwide's bereavement support is the route. Employees, former employees and job applicants have their own route: email SpecialistHR.handling@nationwide.co.uk, or write to the Specialist Handling Team, Nationwide House, Pipers Way, Swindon, SN38 1HR. Current staff are directed to the Nationwide intranet. Note that postcode is SN38 1HR, not the SN38 1NW used for the Data Protection Officer in the same building. The answer arrives through a third-party portal on a clock. Nationwide says your data will be available to download for 30 days, access is by one-time passcode, and "Passcodes are valid for 15 minutes and can only be used once" — it also warns that opening the link inside an email app can lose the passcode. Entering an email address on the form is itself the consent to that delivery method.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.