Subject Access Request to Starling Bank

The Starling app already gives you your statements, so most people asking Starling for their information do not need a request at all: from the menu you can tap "Statements and documents", pick a date range and download the lot as CSV, PDF or large-print PDF, standard or certified. What the app has no button for is everything else. Starling's notice says it holds the content of your phone calls with it, information you give it "through the app, by phone, email, or on social media", and biometric data "scanned from the images and audio in the videos you upload, and from your identity documents". Add complaint files, fraud and affordability assessments, and the reasoning recorded behind a frozen account or a declined application. Starling does at least let you read your side of the conversation back: "You can see your message history with customer service in the Starling app", under Help then "Talk to Starling" — but there is no button anywhere that hands you a copy of your record. The request is an email, and which route you use depends on whether you still bank with Starling. Its privacy notice says "You have the right to access information we have about you. To do this, message us in the app if you're a customer, or email us at privacy@starlingbank.com if you're not." That second limb matters: if your account is closed, your phone is gone or you never held an account at all, there is a published route that needs no app and no login. Starling publishes no form, no portal, no list of identity documents for a request and no process for someone making one on your behalf, so expect to be asked for whatever Starling thinks proportionate. It also asks you to keep personal and account details out of email sent to its general help address, so send a request to privacy@ rather than to help@. Starling publishes a deadline, which is worth knowing because several of its rivals do not. The notice says "We'll usually respond to any requests about these rights within one calendar month. But if we get several requests from you, or your request is complex, or involves a lot of information, we might need up to three months to get back to you." That tracks the month you are entitled to and the extension the law allows. If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing. If your account has closed, there is a free route that is not a subject access request and is usually faster. Starling's transaction history policy says it emails your full history as statements within 10 working days of closure, and that "You can contact us and ask for a copy of your transaction history up to 5 years after your account has closed. This service is free of charge" — sent within 7 working days once it has confirmed your identity and email address. The link and password expire after 60 days, so download it. A request is for what statements do not show, and it is still worth making: the notice keeps most information "for six years from the date you stop using Starling products or services". Fraud and scam records are a large part of why people ask, and some of them are not Starling's. Starling names Cifas, Synectics Solutions and Napier as the fraud prevention agencies it shares with, so its own file will show what it recorded and why, while what the fraud database holds needs a separate request to Cifas. On an authorised push payment scam, Starling's account terms give you 13 months from the last payment to report it, say it will normally refund you or explain why within 5 working days, and say it will close the claim "before the end of the 35th working day". They do not publish what you might lose: the reimbursement cap and the excess are set by the Payment Systems Regulator and the Bank of England, and Starling says only that "we will let you know what the excess is at the time you make a claim", while adding that it may waive the excess for customers whose circumstances affected their ability to protect themselves. A request will show the warnings Starling says it gave you and how it assessed the claim. One mailbox does two jobs and one address does neither. privacy@starlingbank.com is both the address for making a request and the address for complaining about how Starling handled one, so say which you are doing in the subject line. Postal complaints go somewhere else entirely — Starling Bank Customer Relations Team, 8th Floor Brunel House, 2 Fitzalan Road, Cardiff CF24 0FG — and the Operations Team one floor below at the same postcode handles Direct Debits and cheques, so neither is the address for a request. Starling also publishes 020 7930 4450 for data protection complaints and general support 24/7, but it does not offer the phone as a way of making a request. Separately, if a decision went against you: Starling says "If your application for an account, product or service is declined, you can ask for it to be reviewed in full by a human", by app message or by email to the same privacy address. That right gets the decision looked at again; a request gets the records behind it. A request about someone who has died is not a subject access request, because rights of access end at death. What Starling publishes for a bereavement is a process for the account and the estate rather than for records: its bereavement guidance covers registering the death, freezing the account, probate above a £30,000 balance and paying out the balance, and asks for a death certificate, the will and the executor's certified ID, by email to help@starlingbank.com addressed to the Bereavement Team or by post to the Duval Square address. It says nothing about asking for the person's data, so expect that to be a separate conversation. If you are making a request about your own records and would rather send it yourself, our free letter tool will write it for you.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.