Data protection and CIFAS markers

CIFAS markers are personal data stored on the National Fraud Database. UK GDPR and the Data Protection Act 2018 give you specific rights over this data — including the right to access it, challenge its accuracy, and request its erasure.

Data protection law is the strongest legal framework for CIFAS marker challenges because it places specific obligations on the organisation that filed the marker. They must demonstrate that the data is accurate, was processed lawfully, and is necessary for the purpose.

Your data protection rights

• Right of access (Article 15) — request a copy of all data held about you, including the CIFAS marker details
• Right to rectification (Article 16) — request correction of inaccurate data
• Right to erasure (Article 17) — request deletion of data that is inaccurate or unlawfully processed
• Right to restrict processing (Article 18) — request that processing of your data is restricted while accuracy is being challenged
• Right to object to automated decision-making (Article 22) — challenge decisions made purely by automated systems

The Subject Access Request

A Subject Access Request (SAR) is your first tool. Submit one to the institution's Data Protection Officer and to CIFAS. They must respond within 30 calendar days. If they fail to respond, that is a separate GDPR breach that can be reported to the ICO and used to strengthen any future court claim.

The SAR response reveals the evidence the institution holds — and often reveals that the evidence is weaker than they claimed. This information is essential for building a strong complaint.