Subject Access Requests: A Guide to Data Rights

What a SAR does

A Subject Access Request, often shortened to SAR, is a request for access to your personal data. It is not a general disclosure exercise, a freedom of information request, or a right to every document that mentions a dispute. It is a right to know whether your personal data is being processed, to receive a copy of that personal data, and to receive supplementary information about how it is being used.

That distinction matters. A document may contain your personal data, someone else’s personal data, legally privileged material, confidential business material, or information covered by an exemption. The practical objective is therefore not to demand “everything”, but to make a request that helps the organisation identify the personal data you are seeking and makes it harder to avoid the real issue.

Making the request

You should start by identifying the organisation that is likely to be the data controller. That may be an employer, council, NHS body, bank, school, university, insurer, landlord, professional firm, charity, platform or other organisation deciding how and why your personal data is processed.

There is no fixed wording required for a SAR. The request does not have to use the phrase “subject access request”, although using that phrase helps avoid confusion. A request can be made verbally or in writing, but writing is usually safer because it preserves the date, wording and scope.

Template request

The wording below can be adapted. It is deliberately practical rather than aggressive. Overloaded requests can invite clarification, delay and avoidable argument. If the matter is urgent because of litigation, employment, safeguarding, housing, medical or regulatory issues, say so briefly and explain why the records matter.

Timeline and clock issues

In most cases, the organisation must respond without undue delay and at the latest within one month of receiving the request. The clock does not normally wait for an acknowledgement. However, the timing can be affected where the organisation reasonably needs information to confirm identity, confirm a third party’s authority, receive a permitted fee, or clarify an unclear request.

The response period can be extended by two further months where the request is complex or where the person has made a number of requests. The organisation should tell you about the extension and explain why within the first month.

Checking the response

A SAR response should not be judged only by its size. A large bundle can still miss key data. A short response may be adequate if the organisation has explained its searches and the relevant data is limited. The better test is whether the response answers the request in a way that can be checked.

Red flags and lawful limits

Not every refusal, fee request, redaction or privilege claim is improper. Some limits are lawful. The point is to test whether the organisation has applied those limits carefully and explained them properly.

Be particularly careful with privilege. Legal professional privilege can be a legitimate basis for withholding information. A better challenge is not “privilege cannot apply”, but “please identify the basis on which privilege is claimed, the categories of documents withheld, and why the claim applies to the material requested”.

Escalation templates

If the response is inadequate, start with the organisation. A concise escalation is usually stronger than a long complaint. It should identify the request, the response, the missing material, the reasons the response appears incomplete, and the remedy sought.

If the organisation does not resolve the issue, prepare the ICO complaint as an evidence bundle. Include the original SAR, proof of receipt, the response, your follow-up, the organisation’s reply, and a short schedule of what remains missing or disputed.