A well-structured complaint letter is the foundation of any successful CIFAS marker challenge. This guide explains what your letter must include, how to frame your arguments, and the legal basis to cite.
Who to Send It To #
Your complaint must go to the Data Protection Officer (DPO) or the Complaints Department of the organisation that recorded the marker — the bank, insurer, or lender named in your CIFAS DSAR response. Do not send it to CIFAS; they will redirect you to the recording organisation.
Essential Structure #
1. Opening — Identify the Marker #
State clearly:
- Your full name, date of birth, and address
- The CIFAS case reference and the recording organisation’s own reference (from your DSAR)
- The category of marker recorded and the date it was filed
- That you are writing to formally dispute the accuracy and/or lawfulness of this recording
2. The Facts — Your Account of Events #
Set out a clear, chronological account of what happened. Stick to facts. Avoid emotional language. Address specifically:
- What the organisation alleges occurred
- What actually happened from your perspective
- Any evidence you have that contradicts the allegation (bank statements, correspondence, transaction records)
3. The Legal Arguments #
Reference the relevant legal basis for your challenge:
- UK GDPR Article 5(1)(d) — Data must be accurate and kept up to date
- UK GDPR Article 16 — Right to rectification of inaccurate personal data
- UK GDPR Article 17 — Right to erasure where data is unlawfully processed
- UK GDPR Article 6(1)(f) — Legitimate interests only applies where the processing is necessary and the individual’s rights do not override it
- CIFAS Handbook — The recording organisation must have met the standard of proof required before filing; a mere suspicion is insufficient
4. The Remedy You Are Seeking #
Be explicit about what you want:
- Removal of the CIFAS marker from the NFD
- Confirmation in writing that the marker has been deleted
- Notification to all other parties to whom the data may have been disclosed
- Compensation (if you have suffered quantifiable loss as a result)
5. Deadline and Escalation Warning #
State that you require a response within 8 weeks (the FCA’s standard complaints deadline). Confirm that if the matter is not resolved satisfactorily, you will escalate to:
- The Financial Ombudsman Service (FOS) — for complaints against FCA-regulated firms
- The Information Commissioner’s Office (ICO) — for data protection complaints
Supporting Documents to Attach #
- Copy of your CIFAS DSAR response
- Copy of your SAR response from the recording organisation (if obtained)
- Bank statements, transaction records, or correspondence relevant to the disputed events
- Any written confirmation that you reported fraud to Action Fraud or the police (if applicable)
- Proof of identity
Tone and Presentation #
Keep the letter professional and factual. Organisations are more likely to take a well-evidenced, legally grounded complaint seriously than one that relies on emotional appeal. Number your paragraphs, use clear headings, and ensure every factual claim is supported by a referenced document.
