What Remains on Record: Recovering Bank Data After Closure

A closed account is an administrative event, not a deletion event. UK banks continue to hold statements, transaction histories, correspondence, call recordings, internal notes and records of decisions about the account for years after the final balance is settled. For a customer who believes a closure was unfair, or who needs to dispute an overdraft, a default or a set-off, that retained material can be the difference between an assertion and a case.

The route to it is the UK GDPR right of access, commonly called a subject access request. It is not a freedom of information request, and it is not the same as a suspicious activity report. It is a request by a data subject for the personal data a data controller holds about them. In a banking context, it can produce a substantial bundle — but it is important to understand what the right does and does not cover before relying on it.

What a subject access request can and cannot retrieve

A subject access request is directed at personal data: information relating to an identified or identifiable living individual. In practice, for a closed bank account, that can include statements and transaction listings, secure messages and letters, notes of telephone calls, recordings of calls where they are retained, complaint records, records of checks and decisions relating to the account, and correspondence between the bank and the customer. Where a closure decision has been recorded in free-text notes or a decision log, those entries may also be personal data if they relate to the customer.

The right does not require a bank to hand over every internal document that mentions the account. Generic policies, procedure manuals, legal advice and material that is not personal data fall outside the right of access. A bank may also hold information about the customer in more than one system, so a request should be framed to capture the relevant teams and record types rather than simply asking for 'all documents'. The Information Commissioner's Office expects controllers to make reasonable and proportionate searches, not an unlimited forensic sweep.

A subject access request can be made by email or post. There is no prescribed form, but the request should be clear that it is made under the UK GDPR right of access. Banks will usually ask for identity verification before releasing data, and they may ask for an account number or former account details to help locate records. If the request is made on behalf of someone else, such as an executor, attorney or appointee, the bank will need evidence of authority.

The one-month clock, and the two-month extension

The standard response period is one month from receipt of the request. That is a calendar month, not a working month. The clock generally starts when the bank has enough information to identify the data subject and verify identity; if the bank asks for clarification, it should tell the customer that the period is paused while it waits for the answer. A bank should not use identity checks as an indefinite delaying device, but customers should expect some correspondence before data is released.

The period can be extended by up to two further months where the request is complex or where a large volume of data is involved. The bank must tell the customer within the first month that it is extending, and explain why. In practice, a closure-related request that spans several teams, call recordings and complaint files may fall into that category. A straightforward request for statements alone is less likely to justify an extension.

Requests are normally free. A bank may charge a reasonable fee, or refuse a request, where it is manifestly unfounded or excessive, but it must be able to justify that position. It should also provide the data in a commonly used electronic format where the request is made electronically and that is feasible. Customers should keep proof of sending and any acknowledgement, because the date of receipt matters if the response is late.

What banks may legitimately withhold

The right of access is not absolute. A bank may redact third-party personal data, such as information about another customer, a joint holder or a member of staff, where disclosing it would breach data protection law. It may withhold material covered by legal professional privilege. It may also rely on certain exemptions in the Data Protection Act 2018, including exemptions connected with the prevention or detection of crime and the apprehension or prosecution of offenders. That can affect material linked to fraud investigations or suspicious activity reporting.

Redactions and refusals should not be unexplained. If a bank withholds information, it should tell the customer that it has done so and, where possible, explain the basis without undermining the exemption. A bundle may therefore arrive with blacked-out sections. That is not necessarily a sign of bad faith, but it is a point to examine carefully if the missing material appears central to the closure decision.

Customers should also be aware that a bank may hold only limited data where a fraud marker or third-party fraud database is involved. In those circumstances, a separate request to the relevant fraud prevention body may be needed. The bank's own records should still show what it recorded and how it acted on the information available to it.

Building the request so it produces usable evidence

A good request is specific but not restrictive. It should identify the former account, the relevant date range and the categories of personal data sought. For a closure dispute, that might include statements and transaction data, correspondence about the closure, call notes and recordings, complaint records, internal closure decision records, and any records of checks or reviews relating to the account. It is sensible to ask for data held by both the account servicing team and any complaints or financial crime team that reviewed the account.

Customers should avoid asking for 'every document' without any scope. That invites a proportionality argument and may slow the response. A short covering sentence can help: the request is for personal data relating to the customer, in the listed categories, for the stated period. If a call recording is important, ask for it early, because retention periods for recordings can be shorter than for statements.

When the bundle arrives, it should be indexed and read chronologically. Statements can be compared with call notes; closure letters can be compared with internal decision entries; complaint responses can be checked against earlier correspondence. A simple chronology of dates, decisions and communications is often more persuasive than a long narrative. The bundle can then support a formal complaint, an overdraft or set-off dispute, or a case to the Financial Ombudsman Service, which can consider whether the bank acted fairly and consistently.

Practical limits and next steps

A subject access request is not a substitute for legal advice, and it does not guarantee that the bank will disclose its full reasoning. It is an evidence-gathering tool. If a bank fails to respond within the statutory period, or refuses without adequate explanation, the customer can complain to the Information Commissioner's Office. The ICO can assess compliance, though it does not award compensation. A customer may also seek a judicial remedy.

For many former customers, the records are the first point at which the closure stops being a bare assertion and becomes something that can be tested. The account may be closed, but the record often remains. A clear, well-scoped subject access request is the practical way to reach it in 2026.