What happens to my personal data when I apply for a business loan?

What lenders do with your data

To assess an application, a lender collects and processes company and director information — identity, credit, bank data — and shares some with credit reference and fraud-prevention agencies. This is lawful under UK GDPR when done for the legitimate purpose of assessing and administering the loan, and set out in their privacy notice.

Your rights over it

Under UK data protection law you can ask what a lender holds about you, have errors corrected, and understand how automated decisions are made. If you withdraw, the lender should stop using your data for that purpose, though records of any search already run persist for their normal period. Read the privacy notice before you share anything.

Applying safely

Only apply through the lender's own secure (HTTPS) site, check the firm is genuine, and use regulated Open Banking rather than sharing banking passwords. Never send bank login details by email. A legitimate lender is transparent about data handling; evasiveness is a warning sign. The questions-to-ask answer includes checking this.