Subject Access Request to Revolut

Two Revolut companies can be your controller, and Revolut says which one depends on you. Its UK privacy notice reads "In the United Kingdom, either Revolut Bank UK Ltd or Revolut Ltd will be the primary controller of your personal data depending on which entity you've onboarded to. You can check this by viewing the T&Cs which apply to your account." Revolut Bank UK Ltd (company number 12871051, ICO registration ZB304524) is authorised by the Prudential Regulation Authority; Revolut Ltd (company number 08804411, ICO registration ZA114540, the number shown on this page) is authorised by the Financial Conduct Authority under the Electronic Money Regulations 2011. Both sit at the same address and both use the same mailbox, so one email reaches the right team either way — the distinction matters if you have to name a controller in a complaint to the ICO. Investment records sit with Revolut Trading Ltd, a third company and a separate controller. The "subject access request" you can download in the app is not a subject access request. Revolut's help centre article explains how to download a document by that name, and the document contains only four things: your name, date of birth, email and address; masked card details; card top-up details; and the devices linked to your account. It has no transactions, no chat transcripts, no complaint file, no fraud or risk assessment and no reasoning behind a decision about your account. The right described in the privacy notice is much wider — "If you ask, we'll provide a copy of the personal data we hold about you" — and neither page mentions the other. If you want the record rather than the summary, email the address above and say what you want. If you cannot get into the app, email still works, and it is the only thing that does. Every route Revolut publishes for statements and documents needs the app, including the branch written for people who have lost access: "Open the Revolut app on your mobile device… Tap 'Lost access to my phone number'… you may be asked for a one-time passcode, to take a selfie, or to take a picture of an ID." A subject access request is different — it goes by email and needs no app, no login and no working phone number, and you can write the request yourself for free. Revolut also accepts a request made by someone acting for you: "If a third party exercises one of these rights on your behalf, we may need to ask for proof that they've been authorised to act on your behalf." Revolut says it may take up to one month, and publishes no extension. Its notice reads "When you exercise one of your rights, or update your privacy settings in the Revolut app, it may take us up to one month to respond or implement your changes", and the words two months, three months and extension appear nowhere on it — so the one month you are entitled to is also the longest Revolut says it will take. On cost: "Revolut will usually not charge you a fee when you exercise your rights. However, we're allowed by law to charge a reasonable fee or refuse to act on your request if it is manifestly unfounded or excessive." Revolut says what it will not give you, and fraud is on the list. Its notice states: "We can't give you any personal data about other people, personal data which is linked to an ongoing criminal or fraud investigation, or personal data which is linked to settlement negotiations with you. We also won't provide you with any communication we've had with our legal advisers." So if your account was restricted or closed over suspected fraud and an investigation is still open, expect that material to be withheld — the request is still worth making for everything else, and it establishes what exists. Revolut publishes its reasons for restricting an account as "an incomplete identity verification, unverified source of funds, or outdated tax information", refers you to the Personal Terms for the full list, and says that where it needs to close an account "we'll inform you via e-mail at least 60 days in advance". A fraud marker is a separate request to a separate organisation, and Revolut runs a separate route for disputing one. Its notice warns that "If you're identified as potentially posing a risk of fraud or money laundering, these agencies might hold your data for up to six years", and its complaints policy names Cifas directly: "To get help with a CIFAS Marker removal request, contact us at marker-disputes@revolut.com… We will review your case and provide a Final Decision with our decision via email, this might take up to 5 business days." Revolut adds that "Filling a complaint directly with Revolut will not overturn our decision, only the direct escalation to CIFAS may help with that." That mailbox disputes a marker; it does not get you your data. To see what the fraud database itself holds, make a separate request to Cifas. Two other mailboxes exist and neither is for a subject access request. formalcomplaints@revolut.com is for complaints, which Revolut escalates to the Financial Ombudsman Service rather than the ICO. bereavement@revolut.com is for a deceased account holder's affairs — "We only communicate about bereavement cases via email" — and Revolut scopes it to managing the account closure process. Rights of access end at death, so that is not a subject access request either. Revolut publishes no telephone number for any of this and no postal route: the address above is the registered office from the notice's regulatory footer, not a request destination. If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.