Third Party Data Access Request (2024)

Requesting data on someone else’s behalf

If you're requesting data from Experian on someone else’s behalf (you’re known as a “third party”), we’ll need a written request from you that includes:

A signed and dated letter from the person whose data you’d like to access. This letter must include:

  • The full name of the person they’re granting authority to
  • What they are authorising them to do

The letter must also include:

  • Their full name
  • Their date of birth
  • Their current address (and address history for the last six years)
  • Their e-mail address if relevant
  • One official form of identity showing their full name, date of birth and their signature. This could be a copy of their passport or driving licence

The letter must also say if they want to access their report online or if they want it posted to them. If they want to access it online, we will post a passkey to their current address. They will need to enter this online.

If you request the report by post, you will also need to provide proof of their address. This could be a copy of a bank statement or utility bill dated within the last three months.

Once we have the above information, we can deal with the request. Visit our Contact us page to find our address details.

Power of Attorney

If you have Power of Attorney for someone and need to access their credit report, please send us the documents below so that you can act on their behalf.

  • Power of Attorney (Property and Affairs LPA). This document (it can be the original or a copy) will only need to be certified by a solicitor if it has not been stamped by the Office of the Public Guardian
  • A photocopy of either the applicant's passport, birth certificate or driving licence
  • Two original documents dated within the last three months, confirming the address you would like the report sent to. Documents you can send include a bank statement, utility bill, mortgage statement, Council Tax bill, credit card statement, mobile phone bill. The two documents must be for different types of bills or statements

If you are a solicitor and have Lasting Power of Attorney for someone then you do not need to send additional documents. Please contact us and we’ll advise you on the process to get your client’s credit information.

Grant of Probate

If you’re requesting a credit report for someone who has died, please provide us with:

  • A copy of the Grant of Probate/Grant of Letters of Administration confirming you are authorised to deal with the financial affairs of the deceased
  • A photocopy of either your passport, birth certificate or full driving licence
  • Two original documents dated within the last three months, confirming where you live and would like us to send the report to

You should ideally complete a Statutory Credit Report application to ensure we have all the relevant information. You can also send a letter including:

  • Name of the deceased and any previous names they may have been known by
  • Date of birth of the deceased
  • Previous addresses for the deceased for the last 6 years

If you do not have the Grant of Probate, please contact us and we’ll help you through the process.

Third Party Data Access Request (2024)

FAQs

How do I reply to a data subject access request? ›

Having that in mind, you can handle the DSAR response process easily by following these steps:
  1. Verify the identity of the data subject. ...
  2. Clarify the request. ...
  3. Check to see if the requester's data is being processed at all. ...
  4. Inspect, collect, and package the data. ...
  5. Provide the data subject with access to their personal data.
Oct 18, 2023

How long does a company have to respond to a data request? ›

What are the time limits? If you exercise any of your rights under data protection law, the organisation you're dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day they receive the request.

How long does a data controller have to respond to a data access request? ›

The data controller must respond to your request within one month. If the request is complex or involves a large amount of information, the data controller can extend the time to respond by a further two months.

What should I redact in a subject access request? ›

Before you consider giving the requester their information, look through it carefully to make sure it really is their information. For example, if you have an email that mentions a number of different people, you should 'redact' (black out) any information which doesn't relate to the person making the SAR.

Do I have to respond to a SAR? ›

You must comply with a SAR without undue delay and at the latest within one month of receipt of the request or within one month of receipt of: any information requested to confirm the requester's identity (see 'Can we ask for ID?

What happens if a SAR request is ignored? ›

If you fail to comply with a SAR, the requester may apply for a court order requiring you to comply. It is a matter for the court to decide, in each particular case, whether to make such an order.

What happens if a company fails to comply with a subject access request? ›

If you fail to comply with a SAR, the requester may apply for a court order requiring you to comply or to seek compensation. It is a matter for the court to decide, in each particular case, what action to take.

Can you refuse a SAR request? ›

You can also refuse to comply with a SAR if it is: manifestly unfounded; or. manifestly excessive.

What to do if a subject access request is ignored? ›

Your request for information is refused or ignored
  1. Write to the organisation. Remind them of your request, and of their obligations under UK General Data Protection Regulation (UK GDPR). ...
  2. Make a complaint to the organisation. ...
  3. Complain to the ICO.

What is the timeline for data access request? ›

Under the GDPR, organisations are generally required to respond to DSARs within one month of receipt. However, this timeframe can be extended by an additional two months in complex cases, taking into account the complexity and number of requests.

Does a data processor have to respond to a subject access request? ›

Who is responsible for responding to a subject access request? If you're the controller, it's your responsibility to respond to a subject access request. If you're a processor, you should handle any request you receive as outlined in your contract with the data controller.

What is provided when responding to a DAR? ›

As consequence, when responding to an access request, in addition to providing the Data Subject with a copy of the personal data undergoing the processing, which for the avoidance of doubt does not require that they provide an actual copy of the document on which the personal data is found, you must provide this ...

Can a third party make a data subject access request? ›

Yes. An individual may prefer a third party (eg a relative, friend or solicitor) to make a SAR on their behalf. The UK GDPR does not prevent this, however you need to be satisfied that the third party making the request is entitled to act on behalf of the individual.

Do I have a right to see emails about me? ›

The right of access only applies to the individual's personal data contained in the email. This means you may need to disclose some or all of the email to comply with the SAR. Just because the contents of the email are about a business matter, this does not mean that it is not the individual's personal data.

How to deal with a SAR request? ›

To comply with subject access requests, you have to:
  1. respond to a request without undue delay and within one month of receipt.
  2. give information in a concise, transparent, intelligible and easily accessible form.
  3. use clear and plain language, especially if you are disclosing information to a child.

Do I have to respond to a subject access request? ›

However, you must reply to them, even if it is just to say you aren't giving them what they have asked for. We recommend you work with the organisation to help them understand your SAR where possible, as this will help you get what you need.

Who should respond to a data subject access request? ›

Who is responsible for responding to a subject access request? An organisation's data protection officer (DPO) will generally be responsible for fulfilling a DSAR, provided the organisation has appointed one. If you don't have a DPO, the duty should fall to someone in your workforce with data protection knowledge.

How do you respond to data security? ›

72 hours - how to respond to a personal data breach
  1. Step one: Don't panic. ...
  2. Step two: Start the timer. ...
  3. Step three: Find out what's happened. ...
  4. Step four: Try to contain the breach. ...
  5. Step five: Assess the risk. ...
  6. Step six: If necessary, act to protect those affected. ...
  7. Step seven: Submit your report (if needed)

References

Top Articles
Latest Posts
Article information

Author: Kimberely Baumbach CPA

Last Updated:

Views: 5427

Rating: 4 / 5 (61 voted)

Reviews: 84% of readers found this page helpful

Author information

Name: Kimberely Baumbach CPA

Birthday: 1996-01-14

Address: 8381 Boyce Course, Imeldachester, ND 74681

Phone: +3571286597580

Job: Product Banking Analyst

Hobby: Cosplaying, Inline skating, Amateur radio, Baton twirling, Mountaineering, Flying, Archery

Introduction: My name is Kimberely Baumbach CPA, I am a gorgeous, bright, charming, encouraging, zealous, lively, good person who loves writing and wants to share my knowledge and understanding with you.