Guide section
Letter structure
A well-structured complaint letter follows a clear format: identification, background, specific grounds for challenge, evidence references, legal framework, and the outcome requested. The letter should be professional, specific, and evidence-led.
Guide section
Essential elements
- Your name, address, and reference numbers
- The marker type and when it was placed
- A factual summary of what happened
- Specific grounds for challenge (dishonesty not proven, procedural failures, proportionality, data accuracy)
- Reference to UK GDPR Articles 5(1)(d), 17, and 22
- Reference to CIFAS filing standards
- Evidence attached or referenced
- Clear statement of what you want (removal + any compensation)
- 8-week response deadline and intention to escalate if not resolved
Guide section
What makes the difference
The difference between complaints that succeed and those that fail is usually the legal framework and evidence structure. A complaint that says 'this is unfair, remove it' will almost certainly fail. A complaint that says 'this marker does not meet the CIFAS filing standard because X, breaches UK GDPR Article 5(1)(d) because Y, and is disproportionate because Z' has a much stronger chance.
Guide section
What not to say
Do not say you did not benefit as your primary defence. A person can be accused of misuse even where they retained no funds. The real question is whether there is evidence of knowledge, control, or complicity, not whether money stayed in the account.
Do not say the issuer must prove the case beyond reasonable doubt. The CIFAS standard is not the criminal standard. Citing the wrong threshold undermines your credibility with the institution and any later reviewer.
Do not make unsupported accusations that the issuer acted maliciously or for commercial reasons. Focus on evidence, proportionality, accuracy, and regulatory compliance. Inflammatory language invites a defensive response rather than a proper review.
Guide section
Requesting restriction as an interim remedy
Where the institution refuses immediate deletion but the dispute is live and causing serious harm, request that the marker be restricted, suppressed, or made non-searchable while the complaint is investigated. This is an interim remedy under Article 18 UK GDPR.
Requesting restriction formally, in writing, creates a record of the institution's response. Where they refuse restriction even as an interim measure, that refusal becomes part of the case at FOS and court stage.