NewsroomCareersContact Us

Data Subject Access Request (DSAR)

If an organisation has turned you down for a product, service or employment opportunity they might advise you to contact a credit reference agency and Cifas for more information about why your application has been declined.

There are a number of possible reasons for your application being declined, including:

To establish if your declined application is caused by something on your credit report, you can obtain a copy by contacting a credit reference agency. If you have a low credit score, you can ask the organisation who declined your application for a manual review and, if the decision remains unchanged, they will be able to tell you the reason why. 

To contact one of the main credit reference agencies, click on the links below:

Cifas is not a credit reference agency. Find out more on our What is Cifas? page. 

To find out if you have been recorded to our database, you need to make a Data Subject Access Request – it will not show up on your credit report.

If your company is being declined for products or services, please advise each company director to complete a data subject access request in their own personal details. If you are a sole trader, please also do the same and complete a data subject access request in your personal details.

If you are looking to check whether you have been registered with us as a victim of fraud, you should check your credit report rather than make a Data Subject Access Request. Get in touch with any of the main credit reference agencies; your report will show Cifas 'victim markers' as well as lots of other useful information that will help you to spot if a fraudster is attempting to use your identity.

Victim markers – ‘Victim of Impersonation’ and ‘Victim of Takeover’ – remain in place for 13 months from the date of submission. Both will appear on credit reports.

How to submit a Data Subject Access Request (DSAR)

Under Data Protection Legislation you are entitled to request a copy of information held about you by Cifas.  This is known as a Data Subject Access Request and is free of charge.  If you wish to request a copy of any data held about you on the Cifas Database, the only way is to apply online.

In line with government recommendations the Cifas office is now closed and therefore we are unable to send or receive post. We have to have your email address so that we can provide a response to you.

To help us locate information we may hold about you, we will need your full name, date of birth, address history for the last 6 years as well as contact details such as your home telephone and mobile number and email addresses.

We also require two proofs of your identity: a photocopy of your valid passport or driving licence and an original bank statement or utility bill (which lists your name and address and must be dated within the last three months). This must be an original document as photocopies and printed copies will not be accepted. Original documents will be returned to you. If you do not have these proofs, please contact us to discuss alternative options.

Unfortunately, we are unable to handle requests over email as we require originals of some documents in order to prove your identity before releasing information about you. We are required by law to respond to your request within a calendar month of receiving a fully completed form, but we aim wherever possible to reply within a shorter timeframe.

The information that you provide to us as part of your subject access request will only be used for responding to your request, which includes verifying your identity, and any queries you may have following our response. We will retain the information you provide to us for up to six years in order to respond to any follow up queries. If we need further information from you in order to help us locate any data that we may be processing about you, we will contact you using the details you provide.

Disputing the Data

If you have received the results of a Data Subject Access Request and would like to dispute the Cifas data recorded in your details, please follow the procedure outlined in your report, contacting the relevant organisation/s.

Step One 

Contact the organisation/s that registered the warning and follow their complaints procedure. If they uphold your complaint, they can remove the entry and it will be deleted from our system. In your email or letter to them, remember to:

•    Detail exactly what you're complaining about, including why you think the Cifas warning is unwarranted;
•    Include copies of any documents that support your case, and any correspondence you've received;
•    Keep copies of all your correspondence from this point.

In most cases, disputes are resolved at this stage. 

Step Two

If you are not satisfied with the organisation's response, ask them for a Final Response letter (if you haven’t received one), which confirms that they have investigated and that they are rejecting your complaint. 

Step Three

Share that letter with us and we will conduct an independent review on your behalf. Please include in your correspondence: 

We'll review your complaint with the organisation concerned and confirm whether it followed the right procedures. We aim to resolve all investigations within 14 days, however please note some complaints can take longer to resolve.  We do not have the power to recommend financial awards but we will offer as much advice and guidance as possible. 

Further Steps

If, following our investigation, we believe the filing was correct, but you would like to continue disputing the case, the next step is to contact the relevant regulator or complaints scheme for the industry. 

In most of our cases the relevant scheme is the Financial Services Ombudsman but it does depend on the industry in question. For example, a case involving a telecoms company would be referred to the Communications and Internet Services Adjudication Scheme (CISAS). If you are not sure who to go to, just ask and our team will be able to direct you. 

If you're still not sure where to start, please send your complaint or enquiry to our Consumer Affairs Team and we will advise you. When contacting us, always include your name, current address (with postcode) and full details of your enquiry. Please do not send any identity documents or money unless we've asked you to.


Latest blog posts