How To Make A Subject Access Request

You have the right to ask any organisation for a copy of the personal data it holds about you. It costs nothing, and a short email is enough.

What has changed is what happens next. The Data (Use and Access) Act 2025 reshaped how organisations handle your request — and, since June 2026, how you complain when they get it wrong.

What is a subject access request?

A subject access request, or SAR, is your right of access under Article 15 of the UK GDPR. It applies to almost any organisation holding information about you — an employer, a bank, a landlord, a hospital, a school, an insurer.

You can make one verbally or in writing, including through social media. You do not need a special form. You do not need to mention the legislation. You do not need to give a reason. You simply have to make clear that you are asking for your own personal data.

You can also ask a solicitor, relative or friend to make one for you — they will need to show they have your authority.

People ask for all sorts of reasons. An employee wants the notes behind a grievance. A patient wants their full medical records before deciding whether to complain. Someone going through a separation wants to know what their bank holds. A parent wants the school file on their child. All of those are valid, and none of them needs explaining.

What to include in your subject access request

Put it in writing. A verbal request is valid, but writing gives you a dated record if the organisation later disputes when you asked.

Send it to the data protection officer if there is one — otherwise send it to the organisation and ask for it to be passed on.

Include:

A template you can copy

Keep it short:

Asking for everything is your right, but a narrower request usually gets you the documents you actually wanted, faster.

If the organisation sends its own standard form, you do not have to use it. Filling it in often speeds things up, but your original request still stands.

How long does an organisation have to respond?

One month, running from the day your request arrives.

It can take up to two further months where your request is complex, or where you have made several. It has to tell you inside the first month that it is extending, and explain why.

Since the time limit rules came into force on 5 February 2026, there is a new wrinkle. If the organisation reasonably needs you to clarify what you are asking for, or to confirm who you are, the clock stops. It restarts the day after you reply.

So reply quickly. A fortnight spent ignoring a request for ID is a fortnight added to your own wait.

One thing it cannot do is force you to narrow your request. If you repeat it, it still has to search.

What an organisation does not have to give you

This is where most people are disappointed.

The organisation only has to carry out a reasonable and proportionate search. Section 78 of the Data (Use and Access) Act 2025 wrote that standard into Article 15. It is not required to turn over every stone.

That cuts both ways, and a well-known case shows why.

In Michael Ashley v HMRC [2025] EWHC 134 (KB), the Sports Direct founder asked HMRC for the data behind an enquiry into one of his tax returns. HMRC took the extra two months, then refused. When he issued proceedings, it accepted it had breached the rules — and the court found its search had been too narrow, because it had overlooked an agency within HMRC that also held his data. The court ordered HMRC to think again. We covered the HMRC decision in full when it was handed down.

So “reasonable and proportionate” is not a free pass. If an organisation wants to argue that a wider search would have been disproportionate, the burden of showing that sits with it, not with you.

Some material is genuinely exempt. The two you are most likely to meet are legal advice protected by privilege, and information that would reveal someone else’s personal data, unless they agree. Expect redactions, and expect them to be explained.

A request can also be refused where it is manifestly unfounded or excessive. The threshold for that is high, and the organisation has to justify it.

If it refuses, wholly or in part, it must tell you why — and tell you how to challenge it.

What to do if your request is ignored or refused

The route changed on 19 June 2026, and this is the part most guidance has not caught up with.

Complain to the organisation first. Every organisation must now have a data protection complaints process, and must acknowledge your complaint within 30 days. Set out plainly what is missing or wrong and what you want done about it. The ICO explains how to complain to an organisation on its website.

If that does not resolve it, take it to the Information Commissioner’s Office. The ICO will expect to see that you gave the organisation a chance to put things right first, so keep your correspondence. A short, dated email trail is worth far more at that stage than a long phone call nobody wrote down.

You can also enforce the right through the courts. Where a failure has caused you real distress or loss, our data breach solicitors can advise on whether you have a claim for compensation alongside it.

How Nelsons can help

Most subject access requests do not need a solicitor. The ones that do are usually where the answer matters — an employment dispute, a complaint about care, a contested estate, or a response that looks thinner than it should.

We can draft the request, press for a proper search where the response looks thin, and take it through the complaints route if it stalls. We also advise organisations on responding to a subject access request.

The right of access is one of the few parts of data protection law that works for you rather than about you. It costs nothing to use, and a single email starts it. Most people never do.

If you found this useful, please think about sharing it with someone who might need it.