How to Get Your Free Statutory Credit Report From All 3 CRAs

Every UK consumer has a legal right to see the credit information held about them by each of the three main credit reference agencies (CRAs): Experian, Equifax, and TransUnion. This right is established under both the Consumer Credit Act 1974 (sections 157–159) and UK GDPR Article 15, and it applies across England, Wales, Scotland, and Northern Ireland.

A statutory credit report is a copy of the credit information a CRA holds on file about you. It is free of charge under UK GDPR. All three CRAs offer the report through online and postal channels, though the process and timeframes differ between them.

This guide explains how the statutory credit report system works, what the report contains and does not contain, and what to expect when requesting one from each agency. It does not provide financial advice.

• Entitlement: You are legally entitled to a free copy of your credit report from each of the three main UK credit reference agencies: Experian, Equifax, and TransUnion. There is no charge for this report under UK GDPR.
• Content: A statutory credit report shows the credit information a CRA holds about you. It does not include a credit score. All three CRAs explicitly confirm that credit scores are separate from the statutory report and are available through different paid or freemium services.
• Method: You can request your report online or by post from each agency. Not all lenders report to all three CRAs, so the information held by each agency may differ. For this reason, checking with all three agencies provides the most complete picture of the credit information held about you.

The statutory credit report exists because of two overlapping pieces of UK legislation.

The first is the Consumer Credit Act 1974. Section 158 of this Act requires credit reference agencies to provide consumers with a copy of the information held about them. Section 159 provides the right to have wrong information corrected. Historically, CRAs were required to provide this report within 7 working days and were permitted to charge a fee of £2.

The second is UK GDPR (the UK General Data Protection Regulation), which came into force in May 2018 alongside the Data Protection Act 2018. Article 15 of UK GDPR gives individuals the right to obtain a copy of their personal data from any organisation that holds it, including credit reference agencies. Under UK GDPR, this access must be provided free of charge. Section 13 of the Data Protection Act 2018 specifically addresses the obligations of credit reference agencies under this framework.

Since UK GDPR came into effect, statutory credit reports have been free. The previous £2 fee under the Consumer Credit Act 1974 is no longer chargeable.

All three main CRAs — Experian, Equifax, and TransUnion — are authorised and regulated by the Financial Conduct Authority (FCA). Their authorisation status is verifiable on the FCA Financial Services Register.

When you request a statutory credit report, the CRA must verify your identity before releasing the information. This is typically done through automated online checks, but in some cases the agency may ask for additional documentation. Once your identity is confirmed, the report is made available either online or sent by post.

Who has a credit report

In most cases, CRAs hold information on adults aged 18 or over who have had credit accounts, bank accounts, loans, credit cards, or utility contracts in the UK. Individuals with no credit history may not have a report held by any CRA.

Cost

The statutory credit report is free under UK GDPR. Prior to May 2018, CRAs were permitted to charge £2 under the Consumer Credit Act 1974.

What the report includes and excludes

A statutory credit report includes the credit information a CRA holds about you. All three CRAs explicitly state that statutory reports do not include a credit score. Credit scores are generated by the CRAs separately and are available through their own paid or freemium products.

Requesting from Experian

Experian offers both online and postal requests. For online requests, a passkey is posted to the applicant within 5 working days; the report becomes accessible online once the passkey is received and the applicant registers and completes identity verification. For postal requests, Experian states it usually takes up to 7 working days for the report to arrive, though it may take longer if additional identity verification is required.

Requesting from Equifax

Equifax also offers online and postal requests. Online access is immediate upon account creation and successful identity verification, and Equifax states the report is accessible for life and updated daily upon login. Identity verification may require postal documentation. For postal requests, Equifax states a copy of the statutory credit report will be posted to the applicant's home address as soon as possible but no longer than one calendar month.

Requesting from TransUnion

TransUnion offers online requests via transunionstatreport.co.uk and also accepts postal requests. The specific timeframe for report delivery is not prominently stated on TransUnion's website, so the expected wait is unclear from their published materials. Under UK GDPR, the general right of access timeframe — one month from receipt of the request — would apply.

UK GDPR response timeframe

Under UK GDPR Article 15, organisations must respond to a subject access request without delay and within one month of receipt. The Information Commissioner's Office (ICO) states that the time limit may be extended by a further two months if the request is complex or if the organisation receives a number of requests from the same individual.

Data retention periods

Financial account data is generally retained by CRAs for 6 years from the date of account closure or settlement. If a default was recorded, the 6-year period runs from the default date. County Court Judgments (CCJs) are kept for 6 years from the date of the judgment. Most negative information follows the same 6-year standard.

Search footprints — the records left when a lender or other organisation checks your credit file — are retained for different periods depending on the CRA. Experian and Equifax keep most search footprints for 1 year, though debt collection searches are retained for 2 years. TransUnion keeps all search footprints for 2 years.

"My statutory report will include my credit score."

This is incorrect. All three CRAs explicitly confirm that the statutory credit report does not include a credit score. Scores are generated by the CRAs through their own separate services and are not part of the statutory report.

"I only need to check one CRA."

Not all lenders report to all three agencies. Each CRA may hold different information about the same individual, because their data sources differ. The information on one report may not match the information on another.

"The report should arrive within a few days."

Timeframes vary significantly between agencies and between online and postal routes. Experian's online process involves a passkey posted within 5 working days. Equifax's postal route may take up to a full calendar month. The underlying UK GDPR timeframe allows up to one month, with a possible two-month extension for complex requests.

"The old £2 fee still applies."

The £2 fee was associated with the Consumer Credit Act 1974. Since UK GDPR came into force in May 2018, statutory credit reports have been free of charge. Some older or outdated sources may still reference the £2 figure.

"A credit check and a statutory report are the same thing."

They are not. A credit check (or credit search) is performed by a lender or other organisation to assess creditworthiness, and it may leave a footprint on the credit file. A statutory credit report is a copy of the information held by the CRA, requested by the individual themselves.

Sole traders and partnerships

Statutory credit reports for sole traders or business partnerships may require a postal application rather than an online request. Experian states that sole traders or partnerships can apply for their statutory credit report by post. Equifax offers a separate "Statutory Business Report" for businesses.

Identity verification delays

All three CRAs state that they may request additional identification documents — such as utility bills, bank statements, or copies of identification — if they are unable to verify the applicant's identity through automated checks. This can delay the delivery of the report. Individuals with limited credit history or recent address changes may be more likely to encounter this requirement.

Differences between CRA records

Because not all lenders report to all three CRAs, and each CRA may draw on different data sources, the credit information held by Experian, Equifax, and TransUnion about the same individual may vary. There is no single, unified credit file in the UK.

Notice of Correction

Under section 159 of the Consumer Credit Act 1974, individuals can add a "Notice of Correction" to their credit file. This is a statement of up to 200 words explaining or disputing an entry on the report. The Notice of Correction remains on file for as long as the data it relates to is retained.

Vulnerable individuals and fraud victims

Individuals who have been victims of identity fraud or who are financially vulnerable may, in some cases, receive additional support from CRAs. Since UK GDPR made all statutory reports free, the distinction in access terms is less relevant than it was previously, though debt advice agency referrals may still receive expedited or additional assistance.

When a person requests their statutory credit report, they are exercising a legal right under UK legislation. The report is provided free of charge, and there is no obligation to sign up for any paid product in order to obtain it.

Each of the three CRAs operates its own request process. Some routes are faster than others. Online requests from Equifax, for example, can provide immediate access once identity is verified, while Experian's online route involves waiting for a passkey in the post. Postal routes generally take longer across all three agencies.

Because each CRA may hold different information, a report from one agency does not necessarily represent the full picture of what lenders can see. The 6-year retention period for most credit data means that historical account information, defaults, and CCJs remain visible for a substantial period, while search footprints drop off more quickly — after 1 or 2 years depending on the CRA and the type of search.

If a person finds incorrect information on their report, section 159 of the Consumer Credit Act 1974 provides a mechanism to dispute it and, if necessary, to add a Notice of Correction of up to 200 words explaining the circumstances.

• Legal Right: The statutory credit report is a legal entitlement for UK consumers, grounded in both the Consumer Credit Act 1974 and UK GDPR. There is no charge under current law.
• Three Agencies: All three main CRAs — Experian, Equifax, and TransUnion — are required to provide this report, but each operates its own request process with different timeframes. The report shows credit information only; it does not include a credit score.
• Different Data: Not all lenders report to all three agencies, so the records held by each CRA may differ. Most credit data is retained for 6 years, while search footprints are kept for shorter periods that vary by agency.
• Disputes: Individuals have the right to dispute incorrect information and to add a Notice of Correction of up to 200 words to explain entries on their file. Identity verification may delay the provision of the report, particularly for individuals with limited credit history or recent address changes.