Last updated on July 26, 2025

How to Submit a Subject Access Request (SAR)

If you’ve ever been ghosted by a service, treated unfairly, or just want to know what’s been said about you behind closed doors — this post is for you.

One of the most powerful tools you have under UK GDPR is the Subject Access Request, or SAR for short.

You don’t need a solicitor. You don’t need to explain yourself. You just need to ask.

---

When to Use a SAR

• You suspect a charity, employer, school, or agency is mishandling your case
• You’ve been denied support or treated unfairly, and want to see what led to that
• You want to find out if someone is talking about you behind the scenes
• You want evidence to back up a complaint

If it involves your name, ID, diagnosis, criminal record, or anything identifiable — it counts.

---

Your SAR Template (Copy, Paste, Send)

Use the template below to submit your request by email or contact form. Replace anything in square brackets with your details:

Subject: Subject Access Request under UK GDPR

To whom it may concern,

I am making a Subject Access Request under Article 15 of the UK GDPR. I am requesting all personal data your organisation holds about me, including but not limited to:

- Any emails, internal communications, or notes that reference me (including indirectly)
- Records I have submitted or that others have submitted about me
- Any information shared with third parties about me

Please also include the following:
- The source of any data you hold
- Details of any third parties it has been shared with
- The legal basis on which my data is being processed
- The retention period for my data

My details are as follows:
Full name: [Your full name]  
Other names used (if any): [Optional]  
Email addresses I have used: [List all known]  
Date of birth: [DD/MM/YYYY]  
Relevant time period: [e.g. Jan 2023 – Present]

I request this data in electronic format. Please confirm receipt of this request. You have one calendar month to respond, as required by law.

Sincerely,  
[Your Name]
  

---

What Happens Next?

The organisation must respond within one calendar month — not “when they get round to it.” If they ignore you, give you a vague response, or refuse unfairly, you can escalate it for free.

Click here to report an organisation to the ICO

---

You Have a Right to Know

Don’t let anyone tell you otherwise. You don’t need to be polite. You don’t need to wait. And you definitely don’t need to feel guilty for asking questions about your own data.

Use your voice. Use your rights. Use this template.