How to make a subject access request in the UK

If you want to know what an organisation holds about you, you can ask. In the UK this is called a subject access request, often shortened to SAR. It is the right of access, and the Information Commissioner's Office (ICO), the UK regulator for data protection, explains how to use it. This article follows the ICO's public guidance and only what it says.

One thing to know before you start. The ICO states that, because of changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change. If you are about to send a request, check the ICO's website for the latest version.

What a subject access request is

You have the right to ask an organisation whether it is using or storing your personal information. You can also ask for copies of that information. The ICO calls this the right of access, and says it is also known as making a subject access request, a SAR or a DSAR.

Anyone can make a SAR. The ICO is clear that you do not need a solicitor or a lawyer.

Organisations usually have one month to respond to a SAR. The sources do not go into more detail on the exact start of that period, so it is worth keeping a record of the day you send your request.

What to include in your request

The ICO suggests you include the following in a SAR:

• A subject line or header that says "subject access request".
• The date you are making the request.
• Your name, and any other names where relevant, for example your name before you were married.
• Your email address, home address and phone number.
• Customer account numbers, an NHS number, an employee number, a product number or similar information that can help identify you.
• What personal information you want. Be specific, and where relevant say what information you do not need.
• Details or dates that will help the organisation find the information you want.
• The reason you want the information. You do not have to include this, but it may help the organisation find what you need.
• How you would like to receive the information, for example electronically or printed and sent by post, and any accessibility requirements, such as large fonts.

There is no special wording to learn. The list above is a suggestion from the ICO, not a form you must fill in.

How to send it

The ICO lists the easiest ways to make a SAR:

• Online. Many organisations let you submit a SAR through their website. If you do this, take a screenshot of your request for your records before you press submit.
• Email. You can use the ICO's SAR service to create and send an email request to an organisation, or you can contact the organisation directly.

You can also make a request by post, over the phone or face to face. If you do, keep records of when you made your request and who you spoke to, where relevant.

Finding the right contact

The ICO says you can usually find suitable contact information for the people who deal with SARs in an organisation's privacy notice or on its website.

What the ICO's online service does

The ICO runs a service that creates an email to the organisation you name, with your request for personal information and everything the organisation needs to respond. You also get a copy for your records. The ICO says the organisation should reply to you directly and that the ICO will not see the reply. The ICO says the service takes about 10 minutes.

To use it, you need the name of the organisation and its email address. The ICO adds that you can usually find a suitable email address in the organisation's privacy notice. The ICO also says you should provide:

• proof of ID, either a copy of a passport or driving licence; and
• proof of address, either a copy of a bank statement, a utility bill or a TV licence.

Should you ask for everything?

You can ask for all the information an organisation holds about you. But the ICO warns that this does not mean you will get all of it. An organisation can sometimes refuse to provide all or some of the information.

A broad request may also mean you get back a lot of information you do not need. In some cases the organisation is allowed to take longer to send it.

The ICO's advice is to be as specific as possible when asking for information. That may help you get the fastest possible reply and more useful information back.

Making a request for someone else

You can make a SAR for someone else if you can prove you have that person's permission to get the information for them. The organisation will ask for proof, such as written permission from the person or a power of attorney document. If the organisation is not happy that you have permission, it does not have to give you the information.

If you use the ICO's online service for someone else, the ICO says you should give proof of ID and address for the other person, not for you. You will also need evidence that you are allowed to make the request, for example a signed letter of consent, a power of attorney document, or proof of parental responsibility such as a birth or adoption certificate.

The ICO also asks you to think about the opposite situation. If you let someone make a SAR for you, are you happy for that person to get some or all of your personal information? They could gain access to information you do not want to share with them, such as your medical history.

What this guidance does not cover

The two ICO pages are practical but short. They do not explain what to do if an organisation does not reply in the usual time, whether it can charge a fee, or when it can refuse a request. They only say that a refusal of all or some of the information is sometimes possible. For those points, read the ICO's own guidance rather than relying on a summary.

Where Remove Me fits in

A SAR is a request you send to a named organisation. If you are not sure where your information is visible online, Remove Me offers a free scan with no account needed. You enter your details and the service searches publicly visible web results, known public data breaches (Have I Been Pwned) and a register of data brokers, then shows a report. The report is unlocked with a 6-digit code sent by email. Remove Me does not yet send erasure requests on your behalf.