Does a subject access request cost anything?

Usually not. An organisation can charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive.

How long do they have to reply?

Normally one month from receiving your request. This can be extended by up to two further months if the request is complex, but they must tell you within the first month.

Can they refuse to give me some information?

Yes, in some cases — for example where it would reveal information about another person, or where a legal exemption applies. They should tell you if they are withholding anything.

Subject Access Request (Your Personal Data)

A letter asking an organisation for a copy of the personal data it holds about you, under the UK GDPR right of access — for use in England and Wales and the rest of the UK.

Applies in England and Wales. General information, not legal advice — talk to a lawyer about your situation.

This document isn't on sale in the United Kingdom yet.

You have the right to ask any organisation whether it holds personal data about you and to get a copy of it. This is called a subject access request (SAR). It is usually free and the organisation normally has one month to respond.

The right comes from the UK GDPR and applies across the UK.

When to use it

You want to see what a company, employer, landlord or public body holds about you.
You are in a dispute and want copies of records and correspondence about you.
You want to check your data is accurate.

How it works

Identify yourself — Give the details that help them find you — account number, dates, your role.
Say what you want — You can ask for everything, or narrow it to what you need. A focused request is usually answered faster.
Send it and note the date — Send it to the organisation’s data protection contact if it has one. Keep a copy and the date you sent it.

Making it valid

Only your own signature is needed — no witness or notary.
They may ask for proof of your identity before responding — that is normal.

After signing

If they do not respond — Chase them once the month has passed. If you still get no proper answer, you can complain to the Information Commissioner’s Office (ICO).

Common mistakes

Not giving enough detail for the organisation to find your records.
Expecting documents rather than data — you are entitled to your personal data, which may be provided as extracts.

Questions

Does a subject access request cost anything?: Usually not. An organisation can charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive.
How long do they have to reply?: Normally one month from receiving your request. This can be extended by up to two further months if the request is complex, but they must tell you within the first month.
Can they refuse to give me some information?: Yes, in some cases — for example where it would reveal information about another person, or where a legal exemption applies. They should tell you if they are withholding anything.