Guide section
Data protection and CIFAS markers
CIFAS markers are personal data stored on the National Fraud Database. UK GDPR and the Data Protection Act 2018 give you specific rights over this data, including the right to access it, challenge its accuracy, and request its erasure.
Data protection law is the strongest legal framework for CIFAS marker challenges because it places specific obligations on the organisation that filed the marker. They must demonstrate that the data is accurate, was processed lawfully, and is necessary for the purpose.
Guide section
Your data protection rights
- Right of access (Article 15), request a copy of all data held about you, including the CIFAS marker details
- Right to rectification (Article 16), request correction of inaccurate data
- Right to erasure (Article 17), request deletion of data that is inaccurate or unlawfully processed
- Right to restrict processing (Article 18), request that processing of your data is restricted while accuracy is being challenged
- Right to object to automated decision-making (Article 22), challenge decisions made purely by automated systems
Guide section
The Subject Access Request
A Subject Access Request (SAR) is your first tool. Submit one to the institution's Data Protection Officer and to CIFAS. They must respond within 30 calendar days. If they fail to respond, that is a separate GDPR breach that can be reported to the ICO and used to strengthen any future court claim.
The SAR response reveals the evidence the institution holds, and often reveals that the evidence is weaker than they claimed. This information is essential for building a strong complaint.
Strategic tip
Submit your SAR at the same time as your complaint. The 30-day SAR clock runs in parallel with the complaint process, creating additional pressure if the DPO fails to respond.
Guide section
Using data protection rights in combination
The most effective data protection challenges do not rely on a single right. They combine: an Article 15 access request to force disclosure of the evidence; an Article 21 objection to put the institution on notice that continued processing is contested; an Article 16 rectification request where the marker is inaccurate; an Article 18 restriction request as an interim measure while the dispute runs; and if all else fails, a section 167 DPA 2018 court order application.
Each right creates a separate obligation. Each failure by the institution to respond properly becomes part of the case record. The more obligations the institution fails to meet, the stronger the eventual court or FOS submission becomes.
Record everything
Keep copies of every letter, email, and submission you send. The paper trail demonstrating that you asserted your rights and the institution failed to engage is as important as the underlying complaint itself.