The 28-Day Rule: What Actually Happens When You Dispute a Credit File Entry

You've found something wrong on your credit file — an old address, an account you don't recognise, or a default you thought was settled. You send a dispute. Then what?

This is the part most guides skip, and it's exactly where people lose track and give up. Understanding the process — and the deadline that sits inside it — makes the difference between a dispute that gets resolved and one that quietly stalls.

Where the 28 days actually comes from

Under UK data protection law, when you formally dispute the accuracy of information a credit reference agency (or the lender that supplied it) holds about you, they're required to investigate and respond within a defined statutory window — commonly referenced as 28 days, tied to obligations under the Consumer Credit Act and UK GDPR around inaccurate personal data.

That clock starts from the date your dispute is properly received — not the date you post it, and not the date you first noticed the error. This is why keeping a record of exactly when you submitted a dispute matters more than people expect.

What's supposed to happen inside that window

1. The agency notifies the data source. If a lender supplied the disputed information, the credit reference agency will typically contact that lender to verify it.
2. The lender investigates on their end. They check their own records against your dispute.
3. One of three outcomes follows: the entry is corrected, the entry is removed, or the lender confirms it's accurate and it stays — in which case you should receive an explanation.
4. You're notified of the outcome. If you disagree with the result you can escalate to the Financial Ombudsman, and you also have the right to add a Notice of Correction — a short statement in your own words attached to the entry, visible to anyone who checks your file.

What happens if the deadline is missed

If the agency doesn't respond within the statutory window, the disputed entry should, in many cases, be removed or suppressed while the investigation continues — the burden is on the data holder to justify keeping unverified information on your file, not on you to keep proving it's wrong. This is exactly why tracking the date you raised a dispute matters: it's your evidence if a deadline is missed.

The most common way disputes get lost

Not writing down the date. Sending a dispute and simply waiting to "hear back" with no record of when the clock started means you have no way to know if a deadline has actually been missed, and no leverage if it has. The same 28-day principle applies to financial disassociation requests too.

A dispute without a tracked deadline is just a hope. A dispute with a tracked deadline is a right you can actually enforce.