Your data rights over your credit file

If you have ever had a credit card, a loan or a mortgage, one of three main credit reference agencies holds a file on you¹. That file is a record of your financial history, and lenders look at it when deciding whether to lend to you². The law gives you real rights over it: you can see everything the agencies hold, for free, and you can force errors to be corrected.

Those rights come from the Data Protection Act 2018. You can ask for a copy of your credit file under that Act for free³, and you have the legal right to check your report for free with all three main agencies⁴. The agencies are Experian, Equifax and TransUnion, and each holds a separate file on you, so checking one does not show you everything⁵.

Your right to see your credit file

The starting point is simple: you have a right, by law, to know what personal information is held about you by organisations, and this right is enforced by the Information Commissioner¹. For credit files, that right is exercised through the Data Protection Act 2018. You can ask for a copy under that Act for free³, and the same rule applies however you ask: online, by post, or over the phone⁹.

The right matters because of what the agencies do with your data. Credit reference agencies hold details about you that make it hard to avoid debts¹⁰: they know your address, your previous addresses, and the different names you have had, because lenders share up to date details about you with them¹⁰. They also hold information about most adults in the UK, not just people who have borrowed recently⁶. Even if you have not applied for credit in years, there is very likely a file on you.

You can either ask the agencies to post a copy to you or view it online for free¹¹. The free online services are usually funded by adverts¹¹, and the paid services add extras on top, but the underlying right to the data itself costs nothing. The three agencies are described in more detail on the page about the UK credit reference agencies.

One thing the right does not cover: you can only see your own file. Experian, for example, states it can only provide a copy of your own credit report¹². A partner, spouse or adult child cannot ask for yours, and you cannot ask for theirs.

Statutory credit report: free from every credit reference agency

The formal name for what you are entitled to is the statutory credit report. You have a legal right to access your statutory credit report for free from any credit reference agency¹³, and Experian, one of the three agencies, lists its statutory report as free¹². Citizens Advice confirms the same: you can get a free copy of your credit report from a credit reference agency¹⁴.

The word "statutory" matters. It distinguishes the report you are legally entitled to from the subscription services the agencies also sell, which add scores, alerts and identity protection. The statutory report is the basic, complete copy of the data the agency holds, and it cannot be withheld or charged for beyond what the law allows.

There is one point of disagreement between official sources. The Information Commissioner's Office (ICO), the regulator for data protection, states that making the request is free of charge¹⁵. Guidance from nidirect in Northern Ireland states that a statutory credit report by post costs £2.00¹. The £2 figure reflects the older position under previous regulations, and some guidance still repeats it¹⁶. The ICO's current position is that the request itself is free, but if you apply by post it is worth checking what the agency currently asks for before sending payment.

What your credit report shows

A credit report is information about your financial history, which lenders look at to judge your suitability for their credit products². In practice, that means the file tracks how you use loans, credit cards, bank accounts, mobile phone contracts, car insurance paid in monthly instalments, and some utility companies¹⁰. StepChange lists the same range: debts, bank accounts, loans, credit cards and other credit, bills such as mobile phones, utilities and insurances, plus court judgments and insolvencies like bankruptcy¹¹.

Public records feed in too. The agencies hold details of your previous addresses and information from public sources such as the electoral roll, public records including county court judgments, and bankruptcy and insolvency data⁶. A county court judgment (CCJ) will appear on your credit report, and that is the information a credit reference agency provides to companies¹⁴. In Scotland the equivalent is a decree, and the Registry Trust notifies credit reference agencies of all decrees, recalls and dismissals on a regular basis¹⁷.

Just as important is what the report does not show. Which? lists what is excluded: the amount of money in your current account, your salary, savings accounts, student loans, your criminal record, your medical history, parking or driving fines, and council tax arrears⁷. Nobody can look at your credit file and see how much you earn or what is in your savings.

The full picture of what lenders can see is covered in more detail on what is on your credit report, and how long each type of entry stays is explained in how long information stays on your credit file.

A statutory report does not include your credit score

The statutory report is a record, not a grade. These reports do not include your score¹³, and Experian states the same about its own statutory report: it does not include the Experian Credit Score, or any of the other benefits that come with an Experian account¹².

This catches many people out. Free apps and paid services show a number, usually out of a few hundred or a thousand, and people assume the statutory report will show the same thing. It will not. The score is a separate product built on top of the file data, and each agency calculates its own. TransUnion, Experian and Equifax also use different scales, which is why the same person can hold three different scores at once. The ranges each agency uses are covered in credit score ranges at Experian, Equifax and TransUnion.

What the statutory report does contain is the underlying data: public and private information recorded in your name from UK lenders and public sources from where you live¹². That is the data a lender actually sees when it checks you, so for spotting errors, the report is more useful than a score. If you want to understand how scores are built from that data, see what is a credit score and how does it work?.

How to request your statutory credit report

The process is straightforward. You can make a request verbally or in writing, and the agencies also usually provide an online form you can use to apply¹⁵. To identify you, the agency needs:

• your full name
• any other names you have used or been known by in the last six years, for example your maiden name
• your full address including postcode
• any other addresses you have lived at in the last six years
• your date of birth¹⁵

The agency may need more from you if it cannot verify who you are, and that can slow things down. Sole traders and partnerships apply differently: Experian says they must apply by post using a separate application form and address¹². That reflects the regulations covering credit reference agency files, which apply to individuals including sole traders¹⁸.

If you are working with a debt advice agency, it can apply for you. You can apply for your credit report either online or through a statutory application from the three main credit reference agencies, and Citizens Advice or another registered debt advice agency can apply on your behalf, provided you complete a standard free statutory application and send a signed letter of authority¹⁹. This route matters for people fleeing economic abuse, who may not be able to receive post safely at their own address.

A related but separate right exists under the Consumer Credit Act 1974. Under sections 77, 78 and 79, you can ask a lender for a copy of your credit agreement and a statement of account for a £1 fee, and creditors normally have 12 working days to respond²⁰. That gets you the agreement behind a specific debt, not your whole file. The step-by-step version is on how to check your credit report for free.

Deadlines: how long an agency has to respond

Once the agency has your request, the clock starts. Unless the agency needs more information, it has one month from receiving your request to respond⁶. In certain circumstances it may need extra time to consider your request and can take up to an extra two months⁶. If it does, it should tell you.

For postal reports, delivery is quicker than the legal deadline: your report should be sent to you within seven working days unless the agency needs you to send proof of your identity and address²¹. Experian says the same about its own postal service: it usually takes up to 7 working days for your report to arrive¹².

Different rights run on different clocks, and it helps to keep them apart:

The one-month and 28-day periods overlap in practice. If you dispute an entry, the agency has 28 days from your request to tell you if it has removed the entry, amended it, or taken no action⁷. If you make a formal data protection request for correction, the organisation has one month to respond²². The dispute route is usually faster, and the two routes are compared in how long a dispute takes.

Correcting wrong information on your credit file

Wrong entries are common: a debt you paid still showing as outstanding, an account that is not yours, an address link you do not recognise. You can challenge the accuracy of personal data held about you by an organisation, and ask for it to be corrected or deleted²². This is the data protection right to rectification, and it applies to credit reference agencies and lenders alike.

To use it well, the ICO asks that you state clearly what you believe is inaccurate or incomplete, explain how the organisation can correct it, and where available provide evidence of the inaccuracies²². If your data is incomplete rather than wrong, you can ask for the organisation to complete it by adding more details²².

There is a limit to what an agency can do on its own. The ICO says credit reference agencies cannot amend data on credit files provided by other companies without that company's permission²³. Each of the agencies provides lenders with the facilities to make their own changes to the information you see on your credit file⁶. So in practice a dispute travels: you raise it with the agency, the agency checks with the lender, and the lender must agree before the entry changes.

If the entry stays, you still have options. You can add a notice of correction: a statement of up to 200 words on your own credit reference files, which is free to do⁵. Anyone who searches your file then sees your explanation alongside the entry. The mechanics are covered in notice of correction on your credit report, and what to do if the agency refuses is on when an agency refuses your notice of correction.

The law behind this is explicit. Under section 13 of the Data Protection Act 2018, when a credit reference agency discloses your personal data in response to a request, the disclosure must be accompanied by a statement informing you of your rights under section 159 of the Consumer Credit Act 1974, which covers correction of wrong information²⁶. In plain terms: the agency must tell you, when it sends your file, that you have the right to challenge what is in it.

The full process, including what evidence helps, is on how to correct wrong information on your credit report.

Who else can see your credit file

Your credit report can only be accessed by you or by someone with your permission, which you grant to lenders when you apply for a loan². That permission is usually given in the small print of an application, and it is what allows a lender to search your file. Whether lenders need your permission for every kind of search is covered in do lenders need your permission for a credit search?.

Not every search is the same. Hard checks leave a footprint on your credit file that is visible to other lenders for at least 12 months, and they can affect your credit report and score⁴. Soft checks, used by eligibility checkers, do not. The difference is explained in hard and soft credit searches.

Other groups have narrower access. Employers and landlords can also check your credit report, although they usually only see public record information such as electoral register information, insolvency records and county court judgments, or decrees in Scotland¹⁹. Landlords can only access your credit file with your consent⁸, and in Scotland they can only check your credit rating if you give them written permission²⁷.

Financial links change the picture. If you have a joint account or joint credit with a partner, the lender can have full access to your credit file in the same way it could if it were you applying for credit⁶. This is why a partner's credit history can matter when you apply together, and how to remove an out-of-date link is covered in financial associations and how to remove one. The wider question of who sees what is on who can see your credit report.

How the agencies use your data and your right to be told

Credit reference agencies do not just serve lenders. The information they hold is also used to verify the identity, age and residency of individuals, to identify and track fraud, to combat money laundering and to help recover payment of debts⁶. This is why your file can affect you even when you are not borrowing: the same data is used to check that you are who you say you are.

A common belief is that agencies need your consent to do all this. They do not. Data protection law does not actually require the CRAs, or any other organisation, to have your consent before they are allowed to process your personal data¹⁵. Consent is only one lawful basis for processing, and the agencies rely on others. What the law does require is transparency: an organisation must inform you if it is using your personal data, and it must tell you why it is using your data, what type of data, how long it will be kept, who it goes to and why, whether it is transferred overseas, your information rights, where the data came from, whether profiling happens, how to contact the organisation, and your right to complain to the ICO²⁸.

For credit reference agencies, that transparency duty is met through the Credit Reference Agency Information Notice, or CRAIN. The CRAIN is the standard notice the agencies publish explaining what they do with your data and on what basis. It is the document to read if you want to know how your file can be used beyond lending, and it sits alongside the general right to be informed²⁸.

Two practical points follow from how the system works. First, each agency gets different information from lenders, which means your credit file may not look the same at all three¹¹. Second, the agencies hold details about you that make it hard to avoid debts¹⁰, so moving house or changing name does not give you a clean file: the agencies track previous addresses and aliases, and lenders report to them under those links. Why scores differ between agencies is covered in why your score differs between agencies.

Where to complain and get free help

If an agency will not correct an entry, or misses a deadline, or you believe it has mishandled your data, there is a route to follow. Start by complaining to the organisation itself. It must acknowledge your complaint within 30 days, keep you informed of progress, and give you an outcome without unjustifiable or excessive delay²⁹. The ICO's guidance on data protection complaints sets out what to include and what the organisation must do²⁹.

If that does not resolve it, you can refer the matter to the Information Commissioner's Office under the Data Protection Act 2018³. The ICO is the regulator for data protection in the UK, and its complaint route is free. Related rights can strengthen a complaint: the right to object to the use of your information³⁰, and the right to erasure, where an organisation has one calendar month to respond to a deletion request³¹.

Free, impartial help is available at every stage:

• Citizens Advice can apply for your credit report on your behalf with a letter of authority, and advises on credit file problems generally¹⁹
• National Debtline and Business Debtline publish free guides on credit reference files and disputes³
• StepChange and other debt charities explain how credit files work alongside debt problems¹¹
• The ICO handles complaints about how agencies handle your data²⁹

If the problem is not the agency but a debt that is not yours at all, that is identity fraud, and it needs a different response: reporting it, disputing the entries, and possibly adding protective markers to your file. That process is covered in identity fraud and your credit file and Cifas markers and Protective Registration.