The right to access your personal data — formally called the right of subject access — is one of the most practically powerful rights in the UK General Data Protection Regulation (UK GDPR), which is the retained version of EU GDPR incorporated into UK law by the Data Protection Act 2018. This right allows you to ask any organisation, company, government body, or individual that holds personal data about you to: (1) confirm whether they are processing your data; (2) provide you with a copy of the data; and (3) provide supplementary information about how and why the data is used. This article explains the right in full and how to use it effectively.
What is a subject access request?
A Subject Access Request (SAR) is a formal written request to a data controller asking them to provide information about and a copy of the personal data they hold about you. Under Article 15 of UK GDPR, you are entitled to receive: a copy of your personal data being processed; the purposes of the processing; the categories of data; the recipients (or categories of recipients) to whom the data has been disclosed; the envisaged retention period; information about your rights to rectification, erasure, and restriction; the right to lodge a complaint with the ICO; the source of the data (if not collected from you); and information about any automated decision-making, including profiling. There is no need to give a reason for a SAR. You simply ask.
Who can you send a SAR to?
You can send a SAR to any "data controller" — any person or organisation that determines the purposes and means of processing personal data about you. This includes: employers (past and present); banks, insurers, and financial services providers; NHS trusts and GPs; social media companies; online retailers; local councils; courts and tribunals (subject to some exemptions); schools and universities; and law firms that have acted for you. If a third party (such as a detective agency, a former employer's solicitor, or an insurance company's fraud investigators) holds data about you, you can SAR them too.
How to make a subject access request
A SAR can be made in any format — email, letter, or online form. There is no prescribed form. Write to the organisation's data protection officer (DPO) or its general data protection contact. State clearly: "I am making a subject access request under Article 15 of UK GDPR. Please provide me with a copy of all personal data you hold about me." Be as specific as you can about which data or time period you want — this helps the organisation respond more quickly and reduces the risk of an overly broad response. The organisation must respond within one calendar month. For complex or large requests, they can extend to three months, but they must tell you within the first month that they are doing so and why. The response is free of charge (organisations cannot charge a fee unless the request is "manifestly unfounded or excessive").
Exemptions and partial refusals
Organisations can redact data relating to third parties (to protect those third parties' privacy). They can rely on certain exemptions — the most common are: legal professional privilege (data covered by privilege, such as a solicitor's advice); management information prepared solely for pay negotiations; regulatory investigations where disclosure would prejudice the investigation; and data held solely for archiving in the public interest. If an organisation partially refuses your SAR, it must tell you which exemption it relies on. If you believe the refusal is wrong, you can complain to the Information Commissioner's Office (ICO). The ICO has enforcement powers including ordering the organisation to comply and issuing significant fines for serious breaches. The time limit for an ICO complaint is generally three months from the last substantive response (or failure to respond) from the organisation.
Practical uses of a subject access request
SARs are powerful tools in several contexts: Employment disputes — an employee bringing an unfair dismissal or discrimination claim can SAR their employer to obtain HR records, internal emails discussing their performance or conduct, and any other data the employer holds about them. This often reveals documentation the employer did not intend to disclose in the litigation. Personal injury claims — a SAR to an insurance company or medical records holder can produce data relevant to the claim. Credit and financial disputes — a SAR to a lender or credit reference agency reveals what data they hold, allowing you to identify and correct inaccurate data. Social care — a SAR to a local authority or NHS trust reveals the records they hold about you or your family. See the Online Safety Act enforcement news item and the duty of care entry for related topics on digital rights.