Companies House
We read the privacy notices published across central government, councils, tax and benefits offices, health bodies and policing. These are the patterns that repeat. A public body is not a company and you are not its customer: it holds your record because a law lets it, which changes what you can ask for and what you can expect back.
Reported incidents
Filing service let users see other companies' directors' home addresses
2026-03-13Affected WebFiling
Companies House closed its WebFiling service on 13 March 2026 after finding that a logged-in user could see data from other companies' records, including dates of birth, residential addresses and company email addresses, and could in theory file on another company's behalf. The fault came in with a system update in October 2025. The service reopened on 16 March after independent testing. Companies House said passwords and identity verification data were not exposed, reported the issue to the ICO and the National Cyber Security Centre, and emailed companies at their registered addresses.
People affected typically ask Companies House to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.