Subject Access Request to NatWest

NatWest publishes its subject access information in two places that do not link to each other, and each is missing what the other has. The support page carries the postal address, the phone routes and the detail of how the answer comes back. The triage page carries none of those, and carries the things worth reading before you send anything. NatWest's own privacy notice points at the second one, so a reader who follows it never sees the address or the number. Seven years of statements are already in Online Banking. The triage page says they are there "as long as your account has been open throughout that period", and lists statements among the things a subject access request is not the best way to obtain. That qualification is the useful part: the window only covers a period the account was open throughout, so it does not reach an account you have closed. The file goes back further than the statements do. NatWest's full privacy notice (March 2026, section 12.3) says it normally keeps customer account records for up to ten years after your relationship with the bank ends, and the triage page repeats the figure. So a request earns its keep on the years the statement window cannot reach, on a closed account, and on everything that is not a statement — call recordings, complaint and customer service notes, application forms, and the identification taken when the account was opened, all of which NatWest lists as examples of what you can ask for. The answer comes back through a portal rather than the post. NatWest says you will get an email carrying a link to it; entering your email address there generates a one-time passcode valid for 15 minutes, and NatWest advises opening the link in a browser rather than in your email app. The files stay downloadable for 30 days, after which you have to ask through the portal again. There is no email address to send the request to. NatWest publishes three and none of them is a way in. privacy@natwest.com is the address the acknowledgement arrives from. NatWestDataProtection@natwest.com is the Data Protection Officer's, given in the privacy notice for complaints about how NatWest has handled your information — a request sent there lands in the complaints queue. SARCustomerQueries@rbs.co.uk is for a request you have already made, and the triage page pairs it with "Please do not complete a new SAR request." That last one is worth keeping for a chase-up, and it appears on the page only as a link, never as printed text. If the month passes with nothing, it is worth checking what a complete response should contain before you write. If you would rather write than use the form, address it to the DSAR Team at the Manchester address above — our free letter tool will produce one — and note that NatWest asks a written request for your account type, sort code and account number as well as your name, date of birth and address. The number above is NatWest's ordinary personal banking line rather than a dedicated one. NatWest publishes it against the right of access in its privacy notice and tells you to call and say you want to make a Data Subject Access Request. It is open 8am to 8pm, seven days a week; business customers use 03457 11 44 77, which is open 24 hours. Royal Bank of Scotland and Ulster Bank need their own requests. The brands share one platform and one queries mailbox, but each has a separate form — Royal Bank of Scotland and Ulster Bank publish theirs — and Royal Bank of Scotland plc is a separately registered controller, ICO reference ZB498198. Coutts is the exception: it is its own controller at 440 Strand, but its privacy notice sends clients to this same NatWest route, or to their private banker. A marker held by a fraud prevention agency is not NatWest's to release. Cifas takes its own request and does not charge for it; NatWest's privacy notice gives info@nhunter.co.uk for National Hunter. NatWest states the limits up front. The right of access does not entitle you to full copies of original documents, only to the parts of them that are your personal data. Terms and conditions and product literature are not personal data. Information about a limited company, a limited liability partnership or a Scottish partnership belongs to the business rather than to you, and the same business form is used for it. NatWest asks you to be specific about dates and accounts, and says that if you leave the request open it will call you to discuss it. NatWest publishes no list of identity documents anywhere. Its privacy notice says the triage page explains "the documents we need you to submit"; the triage page does not mention documents at all. Expect to be asked something if anything about the request is unclear, and note that the month pauses while it waits. Data protection rights end at death, so this is not the route to a relative's records. NatWest deals with those through its bereavement service, which is open to next of kin, executors and solicitors.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.