making subject access requests

a subject access request is a written request to a business or organisation asking for access to the personal information it holds on you. you can make sars to find out a variety of things, including:

• details of the personal data (eg names and addresses) that is being processed (eg collected or stored) - this generally involved getting a copy of the data

• the reasons why this data is being processed

• how this data was sourced (if available)

• which other organisations or individuals have access to your data

for more information, read data protection requests.

while there is no standard form for how sars should be made (eg post, email, social media or verbally), it is recommended that you make them in writing in order to have a record of the request. consider making a data subject access request.

content of a sar

your sar should, as a minimum, include:

• your full name (including any previous names, where relevant)

• your up-to-date contact details (eg address and telephone number)

• any information used by the organisation to identify or distinguish you from others with the same name (eg account numbers or unique ids)

• details of the specific information you require and any relevant dates

• how you would like to receive the information (eg by email or in print)

while you may request all the information an organisation holds on you, bear in mind that organisations may hold a lot of information and it could take them longer to respond or make it more difficult for you to locate the specific information you need in their response.

a sar should not include information not relevant to your request (eg a wider customer service complaint).

sending a sar

where possible, send your sar directly to the individual or team who deals with subject access requests (eg the data protection officer (dpo)). details on contacting the relevant individual or team are usually written in a privacy policy.

where possible, it is recommended that you:

• keep a copy of any documents or written correspondence for your records

• keep any proof of postage or delivery (eg postal reference number)

• take a screenshot of the form before submitting (if using an online submission form)

where it is not possible to copy the relevant documents, you should consider making a written note of your request, recording any key details, such as:

• the date and time of the request

• details of the personal information requested

• details of any further information the organisation asked you to provide

• any reference number provided by the organisation

• the details of any contacts interacted with when making the request

keeping records is helpful if you later wish to follow up on your request, raise any concerns or complain about an organisation’s response.

a sar can be made on someone’s behalf, provided the person making the request has been authorised to do so. examples of people who may wish to make a sar on someone’s behalf include:

• individuals with parental responsibility (or guardianship) requesting information about a child or young person 

• court-appointed individuals who manage someone else’s affairs (known as ‘deputies’ in england and wales and ‘guardians’ in scotland)

• individuals with a power of attorney allowing them to make sars

• solicitors acting on their client’s instructions

• friends or relatives that the individual feels comfortable asking for help

organisations need to be satisfied that anyone making a sar on behalf of someone else is authorised to do so and may ask for formal supporting evidence to show this (eg written authorisation from the person on whose behalf the request is being made).

for more information on making a subject access request on someone’s behalf, ask a lawyer.

organisations generally have one month to respond to your request. in some circumstances (eg if you have made several requests or where proof of id is required), organisations may need extra time to consider your request and can take up to an extra two months to respond. organisations should inform you within one month if they need more time and explain why. 

while data requests should generally be dealt with and provided free of charge, an organisation may be able to charge a fee in certain, limited circumstances (eg where the organisation finds the request to be ‘manifestly unfounded or excessive’ because it was made to harass or disrupt the organisation).

for more information, read data protection requests.

when organisations respond to your sar, they will typically tell you whether or not they process your personal information and, if they do, provide copies of it. the organisations should also state:

• what they use your information for for

• who they share your information with

• how long they’ll store your information for and how this was decided

• where they obtained your information from

• if they use your information for profiling or automated decision-making and, if so, how this is done

• details on your rights to challenge the accuracy of your information, to have it deleted, or to object to its use

• your right to complain to the information commissioner's office (ico)

• what security measures they’ve taken, if they have transferred your information to a third country or an international organisation

you won’t always receive all the information you have requested. depending on your specific circumstances you may only receive part of the information you requested or the organisation may not provide you with any personal information. for example, you may not receive (all) the information you requested if: 

• the type of information you requested is not covered by a sar (eg information about a deceased relative’s medical records)

• certain exemptions apply (eg it could threaten freedom of expression in journalism, art and literature)

organisations can also refuse to comply with your sar if they believe it to be  ‘manifestly unfounded or excessive’ (instead of charging a fee).

if an organisation doesn’t respond to your sar or you are dissatisfied with their response, you should contact the organisation. if you do not receive a response or remain dissatisfied with the response, you can complain to the ico. you can also consider seeking enforcement through the courts. for more information, read data protection requests.