Credit Reference Agencies and Your Data, Explained

What a credit reference agency actually is

A credit reference agency is a company that gathers information about how people manage money and borrowing, then organises it into a file that lenders, landlords and some service providers can check. In the UK, three agencies hold most of this information: Experian, Equifax and TransUnion. Each keeps its own file on you, which is why the picture one agency holds can differ slightly from another.

It helps to see these agencies as a specific, regulated part of the wider data ecosystem. Unlike a general people-search site, a credit reference agency operates under a clear legal framework and is overseen by the Financial Conduct Authority as well as data-protection law. They are also data controllers under UK GDPR, which means the law gives you defined rights over the information they keep.

Your file typically blends several kinds of information rather than just a single score. Understanding the categories makes it far easier to read your own file and notice anything that looks wrong.

• Identity details such as your name, date of birth and address history
• The electoral roll, used to confirm where you live
• Account and repayment history for credit cards, loans, mortgages and some utilities
• Public records like county court judgments, bankruptcies and insolvencies
• Searches showing when a company has looked at your file

Where the information comes from

Most of what sits in a credit file is reported by the organisations you already deal with. When you open an account or take out a loan, that lender shares regular updates with one or more of the agencies, including whether payments are made on time. This reporting is usually a condition you agreed to when you signed up, often described in the small print as data-sharing with credit reference agencies.

Agencies also draw on public sources. The electoral register helps confirm your address, and court and insolvency records are matched to your file where they apply. Some agencies add information from fraud-prevention databases and, in certain cases, open-banking data that you have chosen to share. The common thread is that the data is meant to be specific, verifiable and tied to genuine financial activity.

Because the information comes from many places, errors can creep in: a closed account still showing as open, an address that was never yours, or a record matched to the wrong person. Seeing your file is the only reliable way to spot these, which is exactly what your access rights are for.

Your rights over your credit data

Under UK GDPR you have the right to see the personal data a credit reference agency holds about you. Each of the three main agencies offers a way to view your statutory credit file, and you can also make a broader subject access request if you want to understand the wider set of information they process. Seeing your file is the first step to checking it is accurate.

If something is wrong, you have the right to ask for it to be corrected. You can raise this with the agency directly and, where the entry was supplied by a lender, with that lender too. You can also add a short note, called a notice of correction, to explain unusual circumstances that the raw data does not capture. Where information is genuinely inaccurate or no longer has a lawful basis to be kept, you may be able to ask for it to be erased, though accurate financial records are often retained for a defined period.

This is general information, not legal advice. If you are unsure how a right applies to your situation, the Information Commissioner's Office (ICO) publishes clear guidance, and you can raise a concern with the ICO if an agency does not handle your request properly. OSINTA helps you see your own footprint and prepare your own requests; the decisions always stay with you.

• Right of access: see the file and the data behind it
• Right to rectification: ask for inaccurate entries to be corrected
• Right to erasure: request removal where data is inaccurate or no longer justified
• Right to add context: attach a notice of correction in your own words

Frequently asked questions

Related terms

• Data broker
• Personal data
• Right to erasure
• Data protection regulator