Looking for answers
Ask a question

What is a Subject Access Request (SAR)?

A Subject Access Request (SAR) is the right of an individual to request any 'personal data' we hold for them. This right is a principle of the General Data Protection Regulation, designed to regulate the processing of information from which a living individual can be identified or singled out either from the information on its own or when combined with other information.

As part of a SAR, individuals have a right to:

  • a description of the information held about them
  • be informed of the purposes the information is used for
  • be informed of the disclosures that are made or might be made
  • be informed of the source of the information
  • be informed of the envisaged retention period for the data
  • be informed if their data is transferred internationally, who the recipients are, and what the adequacy mechanisms for those transfers are
  • Receive a copy of their personal information.

Examples of Personal Information you can request

The following are examples of personal information (assuming that the information in question can be linked to an identifiable, living individual):

  • Contact details
  • CCTV footage
  • Complaints or customer service notes
  • Customer bank statements or related static data (e.g. the content of application forms)
  • Customer medical history
  • Customer spending preferences
  • Customer work experience history (e.g. we may hold evidence of qualifications referenced in a CV submitted to support a business lending application)
  • Employee salary details
  • Notes of meetings from employee disciplinary/grievance hearings
  • Telephone call recordings

Please note: The bank has a tight regulatory deadline of 30 days to meet so identifying these requests within business as usual processes and is vital in assisting us in meeting this timeframe. You may also request a SAR by contacting the bank by telephone or visiting your local branch.

If you require more information about the Act and their rights, you can contact the Information Commissioner's Office (ICO).

A Subject Access Request does not provide the following:

Copies of documents - individuals are entitled to their personal information contained in documents, not the documents themselves.

Terms and Conditions, marketing correspondence and product literature, as these are not regarded as personal information.

Partnerships and Limited Company business information, as this is not personal information.

Generating Certificates e.g. Certificate of Good Conduct, Certificate of Debt.

Information in relation to a deceased person, as the Act only applies to a living individual.

Information in relation to another individual, including spouse, business partners, suspected fraudster or a member of staff, as the right is to the individual's personal information, not another person's information.

Telephone banking
Customers in Scotland
Personal - 03457 242424 (overseas +44 131 5498888)
Business - 0345 6002230 (overseas +44 131 5498888)
Minicom: 0800 404 6160

Customers in England and Wales
Personal - 0345 9000400 (overseas +44 131 2420017)
Business - 0345 3070900 (overseas +44 131 2420017)
Minicom: 0800 068 1289

Open 24 hours a day.
Calls may be recorded.
Call charge information.

Please have your Customer Number and security number ready as this will enable your call to be answered faster and more securely. These are the same details you use to log in to Digital Banking.


Royal Bank of Scotland branch locator
Find your nearest branch using our branch locator (opens in a new window).