Subject Access Request to Royal Bank of Scotland (RBS)

RBS maintains two subject access pages and each is missing what the other has. Its support page carries the postal address, the phone and branch routes and the one-month response time; its triage page carries the statement alternative, the retention figure and the scope exclusions, and its only exit is the form button. Table A of RBS's full privacy notice sends you to the triage page, so a reader who follows the notice never sees the Manchester address. A Royal Bank of Scotland request and a NatWest request are two separate requests. The Royal Bank of Scotland plc and National Westminster Bank plc are separately registered controllers behind one submission platform, and each brand has its own form on it, so someone who has held both accounts has to ask twice. The postal address RBS publishes is nevertheless a NatWest-headed one in Manchester, and the group Data Protection Officer's mailbox is a natwest.com address. RBS publishes two different phone numbers against the right of access. The support page gives 0345 724 24 24 and says its call centres will take the request; the full privacy notice, dated September 2025, gives 0345 788 8444 in its rights section and again in the access row of Table A. Business customers are given 0345 600 2230 on a line the same page says is open 24/7. No opening hours are published for the personal number. No email address takes a request. RBS publishes three and each is for something else: privacy@rbs.co.uk is the address its acknowledgement arrives from, NatWestDataProtection@natwest.com is the group Data Protection Officer for complaints about how your information has been handled, and SARCustomerQueries@rbs.co.uk is for a request already made, which the triage page pairs with "Please do not complete a new SAR request." That last address is never printed on the page; it sits behind a link reading "SAR Customer queries". If your month has run out, check what RBS owes you and when. The answer comes back through a portal rather than by email. RBS emails a link, entering your email address generates a one-time passcode valid for 15 minutes, and your data stays available to download for 30 days, after which you have to ask through the portal for access again. Statements are usually the wrong reason to make one. RBS says seven years of statement history is in Online Banking "anytime you like, as long as your account has been open throughout that period", and its own subject access page says that for a copy of a statement you might not need a request at all. Its app is tighter: seven years is searchable but only twelve months of statement history shows per search. For statements older than seven years RBS points you at its assistant, its contact centre or your service centre, and publishes no fee for them. The categories RBS itself names as requestable are the ones that are not statements: telephone call recordings, complaint and customer service notes, application forms, the documents used to identify you when you opened the account, and your correspondence with the bank. RBS keeps customer account records for up to ten years after the relationship ends and other records for shorter periods, publishes no retention window for call recordings, and says that where you are considered to pose a fraud or money laundering risk the fraud prevention agencies can hold that for up to six years. Name the dates and the product you care about. RBS states two limits before you write. The right of access "doesn't entitle you to obtain full copies of the original documents", and a request "is not a document retrieval process and should not be used as a substitute for legal discovery". Information about a limited company, a limited liability partnership or a Scottish partnership is treated as the business's rather than yours, so a partner in a Scottish partnership cannot get its banking records this way. A request can also be made in an RBS branch, where a staff member will fill the form in for you. A request cannot be made for someone who has died: RBS says data protection laws only protect living people, and sends bereavement enquiries to its bereavement advisors on 0800 161 5904, whose published document list includes the Scottish Certificate of Confirmation. Cifas and National Hunter hold their own fraud records and need their own requests; RBS prints postal addresses for both, and for the credit reference agencies, in section 11 of its full privacy notice.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.