Is this article legal advice?

No. This article is general information only — it explains how the law works in broad terms. It does not take your personal circumstances into account and does not create any lawyer-client relationship. For advice about your own situation, use the Law Society's Find a Solicitor tool, or seek free guidance from Citizens Advice.

Where can I read the original law this article is based on?

All UK Acts of Parliament and statutory instruments are published in full on legislation.gov.uk, maintained by The National Archives. Court judgments are published on BAILII. If this article cites a specific statute or case, the citation in the article links directly to the relevant section.

How do I know this article is up to date?

Each article shows a "reviewed" date in the byline. When a relevant law changes, we update the article and revise the date. For the most current version of any statute, always check legislation.gov.uk — it marks sections that have been amended or are not yet in force. Bills moving through Parliament are tracked on Parliament.uk.

Can I share or quote this article?

You may share the link to this page. If you quote from it, please attribute it to LawTheGuide and note the date you accessed it, as content may be updated. For official or formal use, always cite the primary source — the statute or judgment — rather than this article. The official text is what courts and tribunals apply.

What if the law is different in my country or region?

Each article notes the jurisdiction it covers. Most LawTheGuide content covers England and Wales civil law. Scotland, Northern Ireland, and other countries have different legal systems — some rules are the same, many are not. mygov.scot covers Scottish law, and nidirect.gov.uk covers Northern Ireland. For other jurisdictions, seek local legal advice.

How to write a subject access request that gets results — Articles

A Subject Access Request (SAR) is your legal right under UK GDPR and the Data Protection Act 2018 to obtain a copy of all personal data an organisation holds about you. A well-drafted request gets faster, more complete responses.

Find the right person to write to

Every organisation that processes personal data must have a named contact for data protection queries — usually a Data Protection Officer (DPO). Find them in the organisation's privacy policy (usually linked in the website footer) or search the ICO's Data Protection Register. Address your request to the DPO by name or title. Do not send it to a general customer service inbox — it may never reach the right team.

What to put in the letter

State clearly: (1) that you are exercising your right of access under Article 15 of UK GDPR; (2) a description of the data you want — be specific where you can ("all emails containing my name between 1 Jan and 30 Jun 2026", "all call recordings", "my credit file"); (3) your full name, date of birth, and any account or reference number; (4) a statement that you are not consenting to any further processing. The ICO's subject access request page has a template letter you can adapt.

Keep a timestamped copy

Send by email (not post) so you have an automatic timestamp and delivery confirmation. Forward the sent email to yourself or copy it to a separate folder. The one-month clock runs from the day the organisation receives the request — email gives you clear evidence of receipt. If you must write by post, send by Royal Mail Tracked and photograph the envelope before posting.

What happens next

The organisation must respond within one calendar month. It may ask for proof of identity if it cannot identify you — this is allowed, but it must ask promptly. It cannot charge a fee unless the request is manifestly unfounded or excessive. If it extends the deadline to three months, it must tell you within the first month and explain why.

Following up

If the month passes with no substantive response, write a brief chaser citing the date of your original request and stating you will refer the matter to the ICO if you do not receive a response within 14 days. If that produces nothing, submit a complaint to the ICO. The ICO can investigate and order compliance. You can also apply to court under section 167 of the Data Protection Act 2018 for an order compelling the organisation to comply.

This article is for general information only and is not legal advice. Always check the official source and consult a qualified lawyer for your situation.

Find the right person to write to

What to put in the letter

Keep a timestamped copy

What happens next

Following up

Questions about this article