Subject Access Request to PayPal

For a customer in the United Kingdom the controller is PayPal UK Ltd, not the Luxembourg company. PayPal's privacy statement says "The data controller of your Personal Information is the PayPal entity established in the country or jurisdiction where you reside, which can be found in Our Contact Information", and the UK row of that contact table reads "PayPal UK Ltd, 5 Fleet Place, London, UK EC4M 7RD". No single sentence names the controller outright; it is those two together. PayPal UK Ltd is authorised by the Financial Conduct Authority as an electronic money institution rather than as a bank, and its company number is 14741686. Try the download in your account first, because PayPal points you there before it points you at a request. Its own steps are "Go to Settings. Click Data & Privacy. Click Download your data. Select data options, and click Submit Request." What that report leaves out is where a request earns its keep, and PayPal names the examples itself: "To access specific types of data that aren't included in the standard report, (for example copies of interactions, call recordings) please contact us." Call recordings are on PayPal's own list of what it holds — "Audio, electronic, visual, or similar information: Such as call recordings when you talk to customer service." If your account is closed, or you never had one, there is a route that needs no sign-in. PayPal's privacy hub says "If you closed your account, checked out as a guest, or paid a seller who uses PayPal to process payments, you can use the privacy portal to get a copy of your data", and the privacy portal opens signed out with "No PayPal account? No problem. You can still request a copy of your data." One thing to expect: the portal's only option is headed "Closed account data", so a guest or a buyer who paid a seller may find the hub offers more than the portal does. Someone can ask on your behalf, which is not true of every large platform. PayPal says "We only disclose personal data to the owner of that data or a party authorised by the account holder", and adds that "If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf". The contact page asks you to log in, but publishes an alternative on the same page: a link reading "I can't log in or I don't have an account" opens a form needing only a first name, last name, email address and a message. The reason an account was limited is a recorded decision, and PayPal describes it as an automated one. Its privacy statement says "If we determine that you pose a credit, fraud, money laundering or other risk, we may refuse to provide new services to you, stop providing services you currently use, or place limits or restrictions on the services you use", and that its automated decision making "may use profiling techniques to evaluate personal aspects about you, including to analyze or predict your economic situation, reliability and/or behavior". It also says "Users may exercise rights related to Automated Decision Making, as described in Your Data Protection Rights." Be clear what a request will and will not do: it gets you the records, and it does not lift a limitation, reverse a closure or release a held balance. Those need PayPal's own dispute and complaint process, and a request is worth making alongside that rather than instead of it. A closed account is not a deleted file. PayPal's retention criterion is "the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end", and it reserves the right to keep information longer for litigation, investigations, audit and anti-money-laundering obligations. A request can still reach records of an account PayPal closed years ago. Fraud markers and credit files are other organisations' records. PayPal says information "recorded by fraud prevention agencies" may be shared, and that you should "contact us if you want to receive further details of the relevant fraud prevention agencies" — it names none of them. A marker held by a fraud prevention agency is that agency's record rather than PayPal's, and Cifas takes its own free request. PayPal does name the credit reference agencies it uses in the United Kingdom, in a supplement to its privacy statement: Experian, Equifax and TransUnion, each of which answers for its own file. No response time is published. Nothing on the access article, the contact page, the privacy hub or the privacy portal states a deadline, and the privacy statement's only numbered timescale for a data request applies to Mexico. The one month you are entitled to comes from the law, not from a commitment PayPal has made. There is no fee. A request about someone who has died is not a subject access request, because rights of access end at death. PayPal's route for a deceased account holder closes the account and releases the balance rather than producing records: the executor or administrator of the estate is asked for a cover sheet, details to locate the account and the death certificate, sent "via email at bereavement@paypal.co.uk, or mail us at: 5 Fleet Place, London, United Kingdom, EC4M 7RD", with an indemnity form under £5,000 and a Grant of Probate or Letters of Administration above it. If a reply to your own request arrives and you cannot tell whether it is complete, our free response checker will show you what is missing.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.