Lloyds Banking Group
Closing the account does not close the file. Money-laundering and tax rules keep your identity and transaction records for years, and a permission to share your data wherever the law allows covers much of the rest. The holds set by statute are the ones no request can move.
Reported incidents
App fault showed customers other people's transactions
2026-03-12Affected Lloyds Bank, Halifax and Bank of Scotland mobile apps
On 12 March 2026 a fault in the Lloyds Bank, Halifax and Bank of Scotland apps showed some customers another person's transactions, including payer and payee names, account numbers, card transaction locations and direct debits. Lloyds Banking Group later told the Treasury Committee that 114,182 customers clicked through to other people's transactions and that nearly 450,000 were potentially affected, with a further 80,000 joint account holders. The committee chair called it "an alarming breach of data confidentiality". By late April the group had paid £201,000 in goodwill payments to 5,250 customers, and told MPs it had seen no rise in fraud.
People affected typically ask Lloyds Banking Group to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.