Making a Subject Access Request (SAR) Under UK GDPR

Updated for UK GDPR and the Data Protection Act 2018. Covers how to submit, what organisations must provide, exemptions, and complaints.

A Subject Access Request (SAR) is your legal right to ask any organisation for a copy of the personal data they hold about you. Under UK GDPR, they must respond within one calendar month, free of charge in most cases.

What to include in your SAR

1. Your full name and contact details
2. What data you want — be specific if possible, or ask for all personal data.
3. Proof of identity — organisations can ask for this before releasing data.
4. Dates relevant to the data — for example, account opening to closure.

What they must provide

Organisations should provide:

• The personal data itself
• The purposes of processing
• Who it has been shared with
• How long it will be stored
• Your rights in relation to the data

Exemptions

Some data can be withheld, including:

• Data that identifies another person without their consent
• Data covered by legal privilege
• Data whose disclosure would risk harm
• Some crime and taxation data

What if they refuse or delay?

You can complain to the Information Commissioner's Office (ICO). The ICO can investigate and, in serious cases, take enforcement action. For urgent cases, seek legal advice.

Calendars, response clocks, and "stopping the clock"

The one-month deadline can be paused if the organisation needs to verify your identity (for example, if your request is complex or you have not supplied ID). Once you provide proof, the clock restarts. If a request is "manifestly excessive" or repetitive, they may charge a reasonable fee or refuse — but they must justify that. You do not need to use a special form; a clear email saying "I am making a subject access request under UK GDPR" is enough.

Common uses of a SAR

• Seeing what a former employer, landlord, or bank holds on you.
• Checking the evidence behind a tenancy dispute or a declined application.
• Supporting a letter before action by revealing what the other side actually has on file.
• Finding out why a decision was made about you (credit, insurance, employment).

A SAR is often the first step before a formal complaint or legal claim, because it shows you the documents and data you would otherwise have to guess at.

What to do with the data once you get it

Once the response lands, read it against your dispute. Inaccurate or excessive data can support a letter before action or a tenant complaint. If a decision was made about you on wrong data, you can require it be rectified. The SAR is the evidence-gathering step before any claim.

Ready to draft your Subject Access Request?

LawImNotSure can generate a UK GDPR-compliant SAR letter in minutes. The first document is free with signup.