How do I submit a Subject Access Request (SAR)?
What is a Data Subject Access Request?
Data protection legislation gives you a number of rights. This includes the right to ask if we are using or storing your personal data and for a copy of it. This is called the right of access, sometimes referred to as a Data Subject Access Request. To learn more about how we use your personal data, please read our Privacy Notice available here: Our privacy policy.
How do I ask for copy of my personal data?
There are different ways you can make a request for a copy of your personal data. You can do this online, by phone, in person by visiting one of our branches, or by post. You’ll find more detailed steps for each option in here: How do I contact you to request a copy of my personal data. When making a request, please tell us as clearly as you can what personal data you want, as this can help us to find it faster.
Just to let you know, if you have a general question, or want specific information about one of your accounts (for example a copy of a bank statement, annual interest statement etc.), you might not need to make a Data Subject Access Request. You can simply call us, visit a branch or chat to Cora.
Have you met Cora, your AI Assistant?
Cora can help you with a wide range of queries, including this one.
What will happen after I make the request?
Once we receive your request, we will let you know we’ve got it.
Sometimes, we may need to contact you to clarify what you need or make sure we have the right person. We do this to make sure we don’t share your personal data with anyone who shouldn’t have it.
In most cases we will respond to your request within one calendar month. If we need more time, we will let you know and explain why.
What information will I get?
We’ll send you a copy of personal data we hold about you. The right of access doesn’t entitle you to obtain full copies of the original documents. Sometimes documents or data from our systems include information about other people, in those cases, we will only share the parts that contain your personal data.
What information can’t I get through the right of access?
The right to access relates to your own personal data. This means we will not give you information that is not personal data. For example:
- Terms and conditions, or product literature – these are not personal data. If you need a copy of product terms and conditions, you can visit the relevant product area of our website.
- Business information linked to limited companies, limited liability partnerships or Scottish partnerships – this information relates to the business, not to you as an individual.
- Information about someone who has passed away – data protection laws only protect living people. If you need access to information about someone who passed away, visit Bereavement for details about how to contact us.
- Information about another person – we cannot give you personal data about someone else unless they give you formal permission to act for them. This includes personal data about your partner or a family member, a business partner, someone suspected of fraud, or a staff member. If your personal data is mixed with someone else’s and cannot be separated easily, we will carefully review the request ensuring we balance your rights and the rights of others.
