Your personal data rights
Making a subject access request about your mortgage
A SAR gets your personal data — account notes, call recordings, internal notes about you. It is not a route to the assignment deed.
What this problem looks like
- You want to know what the lender has actually recorded about your calls and your circumstances.
- You suspect the account notes do not match the letters you were sent.
- You have been told a decision was made about your account and nobody will explain how.
What you are trying to establish
- What personal data about you the lender and its servicer hold, and where it sits: account notes, call recordings, field-agent reports, complaint files.
- Who your personal data has been shared with — the recipients or categories of recipients.
- What the internal record says about arrears, forbearance and enforcement decisions concerning you.
Evidence to collect
- Your own contact details as the organisation holds them. Do not send extra identity documents by default: ask the organisation to tell you promptly if it reasonably requires anything further to verify you.
- Your account reference, property address, and the period you want covered.
- A list of the specific dates and calls you care about, which makes it far harder to omit them.
What to ask for
- Account notes and system notes for the account, for a stated period.
- Call recordings and any transcripts of calls with you.
- Correspondence about you, including internal correspondence, not only letters sent to you.
- Internal notes concerning arrears, forbearance and enforcement decisions relating to you.
- Records of information about you shared with third parties, and the recipients or categories of recipients.
- Field-agent or asset-management reports about you and about visits to the property.
- Information held concerning occupation of the property.
- Complaint files and investigation notes relating to your complaints.
What a useful answer looks like
- A response within one month, or a properly explained extension where the request is complex.
- Account notes and call material actually provided, in a legible form, with an explanation of any redactions.
- A statement of the recipients or categories of recipients of your data.
What an inadequate answer looks like
- Copies of letters they already sent you, and nothing internal.
- Silence on call recordings, or a claim that recordings are 'not retained' with no retention period given.
- No response within a month and no explanation of any extension.
What this does not do
- A SAR gives you your personal information. The ICO says an organisation may provide extracts, or edited documents containing your personal information, rather than whole original documents.
- So a SAR is the wrong tool for the mortgage deed, the assignment, the receiver's appointment or an invoice. Those are documents, not your personal data — ask for them separately.
Next escalation
- If the response is late or plainly incomplete, write once setting out exactly what is missing.
- If that fails, complain to the ICO. The ICO expects you to have raised it with the organisation first.
- Where the failure sits alongside a wider mortgage complaint, raise both: the ICO for the data handling, the Financial Ombudsman for the mortgage treatment.
Example letters for this stage
- Full subject access request (mortgage account) — A subject access request under Article 15 of the UK GDPR, framed for a mortgage account.
- Targeted subject access request (arrears and enforcement records) — A narrower request focused on the decisions that led to arrears management, charges or enforcement.
- Complaint to the ICO after a deficient subject access response — Used after the organisation has been given a chance to put a late or incomplete response right.
Official sources
Elsewhere in this archive
More on: Your personal data rights
This is information, not legal advice
Nothing here is legal advice and no professional relationship arises from reading it. Time limits apply to complaints and to court steps. Free help is available from Citizens Advice, StepChange and Shelter.