How to Get a Copy of Your Personal Data

Organisations that hold information about you must tell you what they hold and give you a copy if you ask. This is the right of access, and asking is called making a subject access request (SAR).

Applies in England and Wales. General information, not legal advice — talk to a lawyer about your situation.

Who should read this

Anyone who wants to see what a company, employer or public body holds about them.
Anyone in a dispute who needs copies of records about themselves.

What the law says

The right of access is in Article 15 of the UK GDPR, alongside the Data Protection Act 2018.
A request can be made in writing, by email or verbally, and does not need to mention the law — but a written request is easier to prove.
The organisation normally has one month to respond, which can be extended by up to two further months for complex requests.
A request is usually free. A fee can be charged, or the request refused, only where it is manifestly unfounded or excessive.
Some information can be withheld, for example where it would identify another person or where a legal exemption applies.

Steps

Find the right contact — Check the organisation’s privacy notice for its data protection contact or officer.
Make the request in writing — Say who you are, how they know you and what you want. Keep a copy and the date.
Confirm your identity if asked — They may reasonably ask for proof before releasing data.
Chase and complain — If they miss the deadline or refuse without good reason, complain to them, then to the Information Commissioner’s Office (ICO).

Documents you'll need

Account numbers, reference numbers or dates that identify your records.
Proof of identity, if requested.

Fees

Usually none.

Timeline

One month from the organisation receiving your request, or up to three months if it is complex.

Common mistakes

Making the request so broad that the organisation asks you to narrow it.
Sending it to a general inbox without keeping proof of the date.

Questions

Can I ask for someone else’s data?: Only with their authority, or if you are legally entitled to act for them, such as a parent for a young child.
Can my employer refuse?: Employees have the same right of access as anyone else, subject to the same exemptions.

When to consult a lawyer

The data is needed for an employment or other legal claim.
The organisation refuses and the ICO route has not resolved it.

General information about the law in England and Wales, not legal advice. Find a lawyer for advice on your situation.