Your data rights over a credit reference agency

These are listed in the order worth acting on, which with data rights and credit files is not the order they are usually presented in.

Two overlapping regimes

Credit reporting is governed by financial regulation and, in many countries, by general data protection law at the same time. That gives you two routes when a file is wrong: the credit dispute process and the data rectification right.

The second is often stronger, because it obliges the holder to correct inaccurate personal data rather than to investigate a complaint. Which applies, and how, is jurisdiction-specific, so identify your own framework before citing anything.

The right of access

Many systems give you a right to obtain the personal data an organisation holds about you, usually within a defined period. Applied to a credit reference agency, that means the full file rather than the summary a free product shows. Applied to a lender, it can include account notes, correspondence records and copies of notices.

The useful part is this: this is the route to evidence you cannot otherwise obtain, and it costs nothing in many regimes.

The right to rectification

Where personal data is inaccurate, data protection law commonly requires it to be corrected without undue delay. That right does not depend on the lender agreeing that its own record is wrong, which is what makes it useful after a refusal.

In practice, it applies to factual inaccuracies, not to entries you dislike or to accurate adverse data. Frame the request accordingly: identify the field, state the correct value and attach the evidence.

Automated decision-making

Several data protection regimes give rights around decisions made solely by automated means with significant effects, which lending decisions often are. These can include a right to meaningful information about the logic involved and a right to request human intervention.

Put simply, the scope, exceptions and practical effect differ considerably between countries. Where it exists, it is worth invoking after an unexplained automated decline.

Deletion is limited

A right to erasure exists in some regimes and is generally overridden where the data is held for a legitimate purpose under credit reporting rules. Accurate adverse data will not be deleted on request, and any service promising otherwise is misrepresenting the law. Data held beyond its lawful retention period is a different matter and should be removed.

Knowing which of these you are arguing prevents a request being dismissed outright.

If that does not fit your week, it is not a failure of willpower.

Using the rights properly

Address requests in writing to the organisation's data protection contact, which is usually published. State which right you are exercising and what you want, and keep the request narrow enough to be answerable.

If ignored or refused, complain to the data protection authority in your country, which is generally free. Run this alongside the credit dispute rather than instead of it; the two together resolve cases the dispute process alone does not.

Everything above, in order of what to do first

1. Two overlapping regimes. Credit reporting is governed by financial regulation and, in many countries, by general data protection law at the same time.
2. The right of access. Many systems give you a right to obtain the personal data an organisation holds about you, usually within a defined period.
3. The right to rectification. Where personal data is inaccurate, data protection law commonly requires it to be corrected without undue delay.
4. Automated decision-making. Several data protection regimes give rights around decisions made solely by automated means with significant effects, which lending decisions often are.
5. Deletion is limited. A right to erasure exists in some regimes and is generally overridden where the data is held for a legitimate purpose under credit reporting rules.
6. Using the rights properly. Address requests in writing to the organisation's data protection contact, which is usually published.

The takeaway

Use the access right to get the evidence and the rectification right to fix the field. They work where a credit dispute has stalled.

The version you keep doing is the version that works.