Subject Access Request: How to Make One and Your Rights

You can make a subject access request online through the organisation's website, by email, by post, over the phone or face to face. People can make SARs verbally or in writing, including via social media. You can usually find contact details for the people who deal with SARs in the organisation's privacy notice or on its website.

The ICO suggests you include the following information in a SAR.

• A subject line or header that says subject access request
• The date you are making the request
• Your name, and any other names where relevant, for example your name before you were married
• Your email address, home address and phone number
• Customer account numbers, NHS number, employee number, product number or similar information that can help identify you
• What personal information you want: be specific, and where relevant say what information you do not need
• Details or dates that will help the organisation find the information you want
• The reason you want the information, which you do not have to include but will help the organisation find what you need
• How you would like to receive the information, for example electronically or printed and sent by post, and any accessibility requirements, for example large fonts

You can ask for all the information an organisation holds about you, but that does not mean you will get all of it, because an organisation can sometimes refuse to provide all or some of the information. Being as specific as possible may help you get the fastest possible reply and more useful information back.

After you send the request, keep a copy of any emails or letters, any proof of postage or delivery, or a screenshot if you used an online form or portal. If you made the request over the phone or in person, write down what you asked for and when.

You can make a SAR for someone else if you can prove you have the person's permission to get the information for them. The organisation will ask for proof such as written permission from the person or a power of attorney document, and it does not have to give you the information if it is not happy you have permission to receive it.

For disciplinary matters at work, see our disciplinary procedure guide.

An organisation can ask for ID if it has reasonable doubts about your identity, and it can delay dealing with the request until your identity is confirmed. The ICO says that when asked for ID, you should provide it.

The time limit is one month, counted from the latest of three events. The organisation must provide information on action taken without undue delay and in any event before the end of the applicable time period.

Section 76 of the Data (Use and Access) Act, which amends Article 12 of the UK GDPR to refer to the applicable time period, was in force at 5 February 2026.

The ICO says organisations might ask for more information because they have lots of information about you, they will struggle to respond without it, or you have made a similar SAR in the past. You do not need to give them the information they ask for, but you must reply, even if it is just to say you are not giving them what they have asked for. An organisation cannot force you to narrow the scope of your request.

If the organisation has the information you asked for, it should provide you with copies of it, unless there is a good reason not to. Its response should also include the following.

• What they are using your information for
• Who they are sharing your information with
• How long they will store your information for and why
• Details on how you can ask if the information is correct, ask to have it amended or deleted, or object to or restrict their use of it
• Details on your right to complain to the ICO
• Details about where they got your information from
• Whether they use your information for profiling or automated decision-making and how they are doing this
• What security measures they use if they have or will transfer your information to a country outside the UK or an international organisation

Organisations do not have to give you full copies of the original documents you requested. You can only get your personal information that is contained in the documents, which is commonly known as redaction. For example, a bank does not have to provide copies of your bank statements, but must provide your personal information within them, such as a list of transactions.

If you have said how you would like to receive the information, the organisation should send it in that format where possible. It should not ask you to take action to receive it, such as downloading particular software or collecting it from its premises, unless you have agreed. It must take steps to help you if you have a physical or cognitive impairment or have difficulty accessing or understanding information.

You are only entitled to what the organisation is able to provide based on a reasonable and proportionate search. This change applies retrospectively to 1 January 2024, and the ICO says organisations do not need to conduct searches that are unreasonable or disproportionate to the importance of the information.

If the organisation says it no longer has the information, it may have deleted or destroyed it, because data protection law says organisations should not keep information for longer than they need it. You can check its retention schedule, which you can usually find in its privacy notice or on its website.

Normally, organisations cannot charge for responding to your SAR. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the organisation may charge a reasonable fee taking into account the administrative costs, or refuse to act on the request. It bears the burden of demonstrating that character. For any further copies you request, it may charge a reasonable fee based on administrative costs.

The ICO says there is a high threshold for relying on the manifestly unfounded or excessive provisions, and an organisation should consider each request in the context it is made.

You may not get everything you ask for. An organisation may withhold the following.

• ✗No: Information covered by an exemption that applies, such as legal professional privilege, management information, negotiations with you, confidential references, or exam scripts and exam marks
• ✗No: Information that would reveal information about another person, unless that person has consented or it is reasonable to disclose it without their consent
• ✗No: Information it cannot find after a reasonable and proportionate search

Where an exemption applies, the organisation could refuse to provide all or some of the requested information, depending on the circumstances.

If it does not act on your request, it must tell you without undue delay, and in any event before the end of the applicable time period, the reasons, and that you can complain to the organisation, complain to the regulator and seek a judicial remedy.

There are special rules about requests for some types of personal information, including unstructured manual records, credit files, health information, educational information and social work information.

If the organisation is a council, our council complaints guide covers how to complain to it.

A data subject may make a complaint to the controller if they consider there is an infringement of the UK GDPR. The controller must facilitate complaints, for example by providing a complaint form that can be completed electronically, must acknowledge receipt within 30 days, and must without undue delay take appropriate steps to respond and tell you the outcome. These provisions came fully into force on 19 June 2026.

To complain to the ICO you need an email address for the organisation, a copy of the complaint you made to the organisation, a copy of your request if you made one, and any supporting information about the harm that was experienced.

The ICO says its new approach focuses on cases where it is clear that there is serious harm. Complaints it needs to look at in more detail are currently being assigned to case officers around 10 months after submission.

The ICO cannot act as your representative or award compensation. It cannot award compensation even when it gives its opinion that an organisation has broken data protection law, and it strongly recommends taking independent legal advice on the strength of your case before taking any claim to court. Our Legal Aid guide explains who can get help with legal costs.

The right of access is in the UK GDPR, which gives you the right to obtain from the organisation confirmation as to whether it is processing your personal data and access to that personal data.