How To Make A Subject Access Request

You can make a Subject Access Request (SAR) verbally, however, it is advisable to make such a request in writing to ensure that you have a copy of your request, should you need to refer back to it.

The SAR can simply be a letter setting out the below information. If at all possible you should send the request to the individual or team who deal with SARs, such as a data protection officer. If it is not possible to find the details of the data protection officer you can simply address the letter to the organisation and request that it is passed to the data protection officer for their consideration.

What should you include within your request?

You should include:

• The date of your request (this will be relevant to any timescales for response);
• Your full name and address, together with any aliases you use (if relevant);
• Any information that will be helpful for the organisation to identify you, such as an employee number or customer account number;
• A list of what personal data you would like access to or alternatively you may simply state that you want all of your data. You need to keep in mind that if you are requesting all of your data it may take an organisation longer to respond to your request;
• Any details or relevant dates that may assist the organisation in identifying what data you are wanting;
• You should also include how you would like to receive the response, whether that be my email or post.

The above is not an exhaustive list but should give you an idea what you should include within your SAR.

Sometimes an organisation may respond to your SAR and ask for you to complete their standard form. Standard forms are not compulsory and are not always provided, however, you should complete the form when asked to help the organisation facilitate your request.