Subject Access Request to TransUnion

The free statutory credit report is already a subject access request, and TransUnion says so in its own terms: "At TransUnion there are two kinds of access request you can make: Limited subject access request: provides you with a copy of your credit file. Full subject access request: provides you with any other of your personal data that you specify." The statutory report costs nothing, can be requested "as often as you like", and shows "Financial account information for the last six years", the electoral roll, financial associations and previous names, court judgments, insolvencies and bankruptcies, "searches made against your credit report over the past two years", any Cifas marker, and your notices of correction and dispute. It does not include a credit score. Get it online at transunionstatreport.co.uk, or send the printable form to the Hull PO Box above; if online verification fails, TransUnion says you can ask by email or phone for a copy to be sent by post. One page says a posted copy arrives "within 7 days of your application form being received"; another says "Paper copy requests can take up to 28 days to process". TransUnion posts it only to your current address, never to a third party or an alternative address. A full subject access request is for everything the credit file is not, and it goes by email to the address above, which TransUnion publishes only in its FAQ under "Can I request all information you hold about me?". The categories TransUnion itself lists as yours to ask about are consumer credit reference data, consumer marketing data "such as your name and address on the open register", your employment file if you have worked there, business-contact data, data about users of its products, and your correspondence with it. Through the industry CRAIN notice it also describes tenant vetting for landlords, staff and job candidate vetting for employers, identity and fraud checks, affordability checks, insurance risk assessment and debt tracing — so if your reason is a failed tenancy reference, a job screening result or an affordability decision, that is the full request you want. The reference itself is usually held by the referencing agency or employer that ran it, and the affordability check a gambling operator or lender ran on you sits with TransUnion only where that operator says so — Sky Bet does. TransUnion says it will normally reply "within one month" and will explain why if it cannot. It will not send internal legal assessments, contracts or business records: its FAQ says Article 15 "does not require us to provide internal legal assessments such as Legitimate Interest Assessments (LIAs) or Data Protection Impact Assessments (DPIAs), commercial contracts, business records or information relating to other individuals", and that it holds no copies of your credit agreements — ask the lender or debt purchaser for those. Other people's names and job titles are redacted, legal advice may be withheld, and it will not explain "how we calculate credit scores" beyond general factors. The phone line takes a request for the credit report to be posted to you and is open Monday to Friday, 8am to 6pm; the full request is by email. UKConsumer@transunion.com is the general Consumer Services mailbox and the fallback if you cannot use the online enquiry form. TransUnion publishes its Data Protection Officer at ukdpo@transunion.com (also written ukdataprotectionofficer@transunion.com and dpo@transunion.co.uk on different notices) for complaints about how your data is handled, not for making the request, and a complaint about service goes to UKCustomerRelations@transunion.com or to Customer Relations, TransUnion Information Group, One Park Lane, Leeds, LS3 1EP, acknowledged within 5 days with a final response aimed at within 8 weeks, and after that to the Financial Ombudsman Service or the ICO. Large print, Braille, audio and coloured-paper versions of any correspondence are available from UKSpecialistServices@transunion.com, and you have to ask each time. Getting something corrected is a different right with its own clock. TransUnion says a dispute about an entry on your credit file is investigated under the Consumer Credit Act 1974 with "a 28 day deadline", the entry is marked as disputed meanwhile, and if the lender does not respond within 28 days the data is removed or hidden unless other evidence supports it. Raise it from the "Something not right?" button on your online statutory report, through the Consumer Enquiry Form, by phone or by post to the same PO Box. If the entry is right but needs explaining, a Notice of Correction of up to 200 words can be added for free; it interrupts automated decisions, and TransUnion says it "will not automatically be shared with the other credit reference agencies". A request about someone who has died is not a subject access request — rights of access end at death — and TransUnion publishes no route for one. What it does offer is a Notice of Correction on the deceased person's file, through the Consumer Enquiry Form's "I want to add a notice of a Bereavement" option, with a death certificate sent afterwards, to stop credit being taken in their name. Asking about someone living needs their authority: TransUnion says it may ask for "a power of attorney or letter of authority", and the same form has options for a power of attorney or Court of Protection notice. Credit reference data "generally stays on your credit file for a period of six years"; TransUnion's own retention table says it keeps account data for ten years from closure or default and uses only the most recent six for live decisions, keeps search footprints for six years and shows the most recent two, and keeps electoral-roll data for 16 years after you leave an address. It says a lender's correction "can take four to six weeks" to show on your report. TransUnion is one of three credit reference agencies and they hold different files — its own FAQ says "they can hold slightly different information, so it's worth checking all three". Experian and Equifax are separate controllers with their own routes; a Cifas marker shows on your TransUnion report but the record behind it is Cifas's own request. Credit Karma and the other "partners" TransUnion lists (Checkmyfile and TotallyMoney) show you the same TransUnion data through their own accounts and are separate companies — Credit Karma UK Limited is an Intuit company that pays TransUnion a fee — so a request about your Credit Karma account goes to Credit Karma, not here. TransUnion was Callcredit until 2018 and its postal form still says "Transunion formerly Callcredit". If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.