A mistake on your credit report can have serious consequences—rejected mortgage applications, higher interest rates, or even losing a job offer. If a credit reference agency like Experian, Equifax, or TransUnion has incorrect information about you, you have legal rights.
This guide explains how to correct credit report errors and claim compensation in the UK.
Your Legal Rights Under UK GDPR
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to:
- Access your data – Request a copy of all information held about you
- Have inaccurate data corrected – Organisations must fix errors without undue delay
- Claim compensation – If you’ve suffered damage due to data protection breaches
Credit reference agencies (CRAs) are data controllers under GDPR and must ensure the accuracy of the data they hold about you.
Common Credit Report Errors
Errors on credit reports can include:
- Incorrect personal details – Wrong name, address, or date of birth
- Accounts that aren’t yours – Someone else’s debts appearing on your file
- Wrongly recorded late payments – Payments marked late when you paid on time
- Outdated information – Debts that should have been removed (usually after 6 years)
- Fraudulent accounts – Accounts opened in your name by identity thieves
- Incorrect defaults or CCJs – Judgments you never actually received
- Closed accounts shown as open – Debts marked outstanding when they were paid
UK Case Example: ICO Action Against Experian
In 2020, the Information Commissioner’s Office (ICO) found “widespread and systemic data protection failings” across the credit reference industry. The ICO investigation discovered that Experian, Equifax, and TransUnion were trading and enriching people’s personal data without their knowledge or consent.
The ICO issued Experian with an Enforcement Notice for breaching GDPR requirements around lawful, fair, and transparent processing. While Experian successfully appealed parts of the notice, the case highlighted the ICO’s willingness to take action against CRAs for data protection failures.
Equifax Data Breach Fine
The ICO fined Equifax £500,000 after the 2017 cyber attack that affected nearly 15 million UK citizens. The ICO found that Equifax UK failed to adequately protect UK citizens’ information during the breach.
Step 1: Get Your Credit Reports
Start by checking your credit reports from all three main CRAs:
- Experian – Free via their website or apps like ClearScore
- Equifax – Free via their website or ClearScore
- TransUnion – Free via Credit Karma
Under UK GDPR, you can request a full copy of your data (Subject Access Request) for free.
Step 2: Dispute the Error
If you find an error:
- Contact the CRA – Use their online dispute process or write to them
- Provide evidence – Bank statements, payment receipts, or court documents proving the error
- Contact the lender – The organisation that supplied the incorrect data
- Set a deadline – CRAs should respond within one month (extendable to three months for complex cases)
The CRA must investigate and correct inaccurate data “without undue delay.”
Step 3: Escalate to the ICO
If the CRA or lender doesn’t resolve the issue:
- Complain formally – Put your complaint in writing with all supporting evidence
- Contact the ICO – The Information Commissioner’s Office can investigate data protection breaches
- Note: The ICO can issue fines and enforcement notices but cannot award you compensation directly
Step 4: Claim Compensation
If you’ve suffered damage due to credit report errors, you may be entitled to compensation. You can claim for:
- Financial losses – Higher interest rates, rejected applications, lost opportunities
- Distress – Anxiety, stress, and emotional impact of dealing with the error
- Time and effort – Hours spent trying to correct the mistake
How to Claim
- Complain to the organisation – Request compensation directly
- Alternative dispute resolution – Some CRAs offer mediation
- Court action – Small Claims Court for claims up to £10,000
What Compensation Can You Get?
Compensation depends on the impact of the error:
- Minor errors with limited impact: £100-£500
- Errors causing rejected applications: £500-£2,000
- Serious errors causing significant financial loss: £2,000-£10,000+
- Data breaches exposing personal information: Variable, depending on harm suffered
For data breach claims, compensation can be higher if you can prove significant distress or financial loss.
Time Limits
- Data protection claims: 6 years from when the damage occurred
- ICO complaints: Generally within 3 months of the organisation’s response, though the ICO has discretion
Frequently Asked Questions
Can I claim compensation directly from the ICO?
No. The ICO investigates breaches and issues fines, but doesn’t award compensation to individuals. You must pursue compensation through the organisation directly or through the courts.
What if the error was made by the lender, not the CRA?
You can claim against both. The lender is responsible for providing accurate information; the CRA is responsible for correcting errors when notified. Both may share liability.
How do I prove the error caused me financial loss?
Gather evidence such as rejected application letters, comparison of interest rates you received vs. rates you should have qualified for, and any other documentation showing financial impact.
Can I claim if the error has been corrected?
Yes. If you suffered loss or distress while the error existed, you may still be entitled to compensation even after it’s fixed.
What about fraud-related errors?
If your credit report shows accounts opened fraudulently in your name, you should report this to Action Fraud as well as disputing with the CRAs. You may have claims against multiple parties depending on how the fraud occurred.
Also available for:
