Data Subject Access Requests

A SAR entitles you to receive:

• A copy of all personal data the organisation holds about you (in any format — emails, call recordings, CCTV footage, databases)
• The purposes for which your data is processed
• The categories of personal data held
• The recipients or categories of recipients the data has been or will be shared with
• The retention period (how long the data will be kept)
• Your rights regarding rectification, erasure, restriction, and objection
• The right to lodge a complaint with the ICO
• If data was not collected directly from you, the source of the data
• Information about any automated decision-making, including profiling, and its logic and significance

To submit an effective SAR:

1. Identify the right contact. Most organisations publish a DPO or data protection contact on their privacy page. If not, address your request to "The Data Controller" or the company's general correspondence address.
2. State clearly that you are making a Subject Access Request under Article 15 of UK GDPR. This puts the organisation on notice and starts the clock.
3. Specify the data you are looking for — the more specific you are, the easier it is for the organisation to respond and the more useful the response. For example: "all emails in which I am named or identified," "all data held in your customer database relating to my account," or "all records of calls I have made to your customer service team."
4. Provide enough identification to help them locate your data — your full name, any account number, date of birth, address. You do not need to provide more than is necessary for them to identify you.
5. Send your request by email and keep a copy with a record of the send date.

The one-month response deadline runs from the day after the organisation receives your SAR. For example, if you send a SAR on 5 March, the response is due by 5 April (or the next working day if that falls on a weekend or bank holiday).

The organisation can extend this by up to two further months where the request is complex or you have made multiple requests — but they must notify you within the first month that they are extending, and explain why. If they do not notify you, the extension is not valid.

If the organisation asks you for clarification (for example, to identify which of their systems to search), the clock is paused until you respond. Make sure your initial SAR is specific enough to avoid unnecessary delays.

If the organisation refuses your SAR entirely or you believe the response is incomplete:

1. Ask for an explanation in writing. The organisation should identify which exemption they are relying on.
2. Complain to the ICO at ico.org.uk/make-a-complaint. The ICO can investigate and issue enforcement action. You generally need to have raised the matter with the organisation first before the ICO will intervene.
3. Apply to the court under Section 167 of the DPA 2018 for a compliance order. A court can order the organisation to comply with your request.

Keep detailed records of all communications — the dates of your request, any acknowledgements, the response received, and any follow-up correspondence.