Is Experian safe?

Wollit Team3 minute read · Updated 1st July 2024

Experian is one of the leading credit reference agencies (CRAs) in the UK, and in fact the largest one and the most relied on by banks, credit card providers, and mortgage lenders.

This means that, if you have any credit activity in the UK, Experian has some data on you – which the lenders can access during credit checks.

How safe is Experian?

Experian is a reputable and well-established company, not only in the UK, but worldwide.

The company is regulated by the Financial Conduct Authority (FCA) and adheres to strict data protection guidelines to ensure the security of the personal data it collects.

How does Experian handle my personal data?

Experian collects and maintains information on how people manage debt.

This includes data from banks, credit cards, mortgages, utility companies, and other contracts and credit agreements.

When someone applies for credit, lenders use Experian's credit scores to figure out how risky that person is and if lending to them makes sense.

According to Experian, it takes several measures to protect customer data:

Experian uses advanced encryption techniques to secure customer data, ensuring that it remains confidential and inaccessible to unauthorised parties.
Experian's servers are located in secure facilities, and are protected by both physical and network security measures. This is managed by a dedicated Cyber Security Investigations team.
Experian also runs regular audits to make sure that it stays in compliance with data protection regulations and that it identifies potential vulnerabilities in time. In fact, Experian is annually audited by an external QSA (Qualified Security Assessor) from Trustwave, one of the leading companies in the field.
Access to customer data is restricted only to authorised employees who require it for their work, and all employees are trained on data protection best practices.
The company does not keep personal data for longer than needed, and deletes the data after this period has passed. In the UK, it deletes most data older than six years, which is why your credit report only shows events from the past six years.

Has Experian ever misused data?

Unfortunately, yes. Experian was found guilty of processing data illegally and breaching the data protection rights of up to five million people in the UK.

An investigation by the ICO discovered that Experian was “trading, enriching and enhancing people’s personal data without their knowledge”, by taking personal data from the electoral roll and supplementing it with other information about a person to build a more complete data profile.

These profiles were then sold to companies, charities, and even political parties to help them to target ads more effectively.

Equifax and TransUnion, the other two main credit agencies in the UK, were found to engage in similar practices as well.

All were ordered by the Information Commissioner’s Office (ICO) to make changes to the way they handle personal data.

In any case, though, this data was not sold in a way that could identify you. While it was a clear breach of your personal rights, the companies and parties that bought this data could only show you ads, but they didn’t know specific details about you. Your personal information is still safe.

Was Experian ever hacked?

Yes, Experian has unfortunately been involved in several major data breaches globally over the past decade:

In 2015, Experian announced a data breach affecting approximately 15 million people who used the company's services in the US. The breach exposed names, addresses, and sensitive personal identification numbers such as social security, driver's licence, and passport numbers.
In 2020, Experian suffered a data breach in South Africa, exposing data on 24 million South Africans and nearly 800,000 businesses.
In 2021, Experian's Brazilian subsidiary, Serasa Experian, was linked to a massive data breach in Brazil, exposing the personal information of nearly all Brazilian citizens, including some who had already passed away.

Should I be worried?

We live in an age where cybersecurity risks are growing every day. It’s impossible to say if Experian will be breached again.

However, you should keep a few things in mind:

Experian has never been hacked in the UK.
After every breach happened (in the US, South Africa, and Brazil) the company did significant changes and improvements to its security.
Experian has better security than most other products you use (including social media apps, bank apps, and so on).
Also, the most common thing that a criminal could do with your personal data is to get credit in your name. However, if this happens, you will notice it on your credit report, and you can fix it by reporting the crime to Action Fraud Police and by taking protective registration with CIFAS.

To be fair though, there’s little you can do about it.

This might sound harsh, but regardless if you’re comfortable with the idea or not, lenders need to know what your credit history is, and only credit reference agencies like Experian can provide this data.

In other words, you should continue checking your Experian credit score without worrying too much about the safety of your data.

At the end of the day, what matters more for your finances is improving your credit score.

The good news is that now there are many apps that can help you build and improve credit. One such app is Wollit.

Wollit works by reporting a fixed-fee monthly subscription as a loan repayment to all credit reference agencies, including Experian. This helps you build a history of timely debt repayments, which is the main factor that matters for your credit score.

Checking your credit report for signs of fraud is important, but if you’re looking for an app that can actually improve your credit rating, downloading a credit-building app like Wollit is a more effective thing you can do.