Equifax UK
The brand on the screen rarely runs the check: your document and face route to a verification company, and when the images are deleted the result stays. Fraud exceptions store the rest, and your face can train the next model.
Reported incidents
Fined £500,000 over UK records caught in its US parent's 2017 breach
2018-09-20The Information Commissioner's Office fined Equifax Ltd £500,000, the most allowed under the Data Protection Act 1998, over the 2017 attack on its US parent. Up to 15 million UK records were held on the US systems the attackers reached between May and July 2017. The ICO found Equifax Ltd broke five of the Act's eight principles: it kept UK data longer than needed, had no legal basis to move it to the US and did not secure it. The UK data included names, dates of birth and phone numbers, and for about 20,000 people driving licence numbers. Equifax said it was disappointed in the findings.
People affected typically ask Equifax UK to confirm whether their information was included, and which categories.
The verified route
Where data goes
What Equifax UK likely holds
What ID check services typically hold about you, from our industry research, the most sensitive first.
Pick a folder to see where it goes.
Most sensitive
Sensitive
Everyday
Where it goes
On Equifax UK's behalf
They handle your data on Equifax UK's instructions. If Equifax UK uses them, a request to Equifax UK should reach them.
Inferred services
Services ID check services typically use.
Get their own copy
A request to Equifax UK doesn't reach them. Each needs its own, and some keep records under a legal duty.
Inferred practices
What ID check services typically do with your data, from our industry research.
The provider on record
pure verifier
Credit file data retained per UK credit-reporting standards (typically 6 years for adverse data)
2017: Equifax data breach exposed personal and financial data of approximately 147 million people globally including UK consumers
Stated terms from their published policies, read August 2026. Items on the record are matters of public regulatory or court record.
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.