Short answer: A Subject Access Request lets you see the personal data an organisation holds about you, plus basic details about how they use it. It should usually be free, and they should usually respond within one month. You do not need to use special forms, an email is fine. Below is a copy and paste template, common pushbacks, and what to do when the reply is a mess.
What is a Subject Access Request
A Subject Access Request, or SAR, is how you ask any organisation for the personal data they hold on you. That includes emails, notes, call logs, application records, internal messages that mention you, and more. It also includes why they have it, how long they keep it, and who they share it with.
What you can ask for
- The data itself, not just a summary
- Sources of the data, and any profiling
- Who they shared it with
- Retention periods
- Copies of policies that explain how they handle your data
How to send it, email template
Send this to the organisation’s published contact or their privacy email. Keep it simple and assertive.
Subject: Subject Access Request Hello, I am making a Subject Access Request for all personal data relating to me, across all systems and formats. Please include: * Copies of my data, including emails and internal correspondence that mention me * The purposes for processing and the lawful basis * Any recipients or categories of recipient * Retention periods * The source of the data, if not collected from me * Information about any automated decision making or profiling * A copy of relevant data protection policies that explain how my data is handled For identification, I can provide reasonable proof if required. Please respond in a commonly used electronic format. Regards, [Your name]
Deadlines and fees
They should usually respond within one month. They can extend in some complex cases, they should explain why if they do. A fee should not be charged in normal situations.
Common pushbacks and how to handle them
- They send a summary, not the data. Reply and ask for the actual records, not just a narrative.
- They claim they need a form. You do not, your email is valid. Forms are optional.
- They say it is excessive. Ask them to explain which parts, then narrow by date or system if helpful.
- They redact everything. Ask for a schedule of redactions with reasons, so you can challenge it.
- They miss the deadline. Send a short final notice and prepare to escalate.
Organising the reply
Create a simple folder, one subfolder per source, then build a timeline. Note who wrote what, and dates. This turns a data dump into evidence you can actually use.
Escalation path
- Send a clear follow up that lists what is missing
- Give a short deadline for a complete response
- If they still fail, escalate to the regulator with your timeline and exhibits
Useful internal links
FAQ
Do I need to explain why I am asking No.
Can they refuse if my tone is firm No, tone is not a lawful reason to refuse.
Can they demand ID Only if reasonable for security. They should explain why and accept sensible proof.
What format should they use A common electronic format, not photos of a screen.
Can I limit my request Yes, for speed you can limit by time range, system, or subject line keywords.
Plain English, not legal advice. If your case is sensitive, consider independent advice.
Be First to Comment