How to Make a Subject Access Request in the UK
By Scott Anderson, Clearfront maintainer
A subject access request, or SAR, forces any UK organization to give you a copy of the personal data it holds about you, for free, within one month. It is one of the most useful rights you have, and most people never use it. Here is how to send one. This is general information, not legal advice.
What is a subject access request?
A subject access request is a demand, under UK GDPR, that an organization give you a copy of the personal data it holds about you. It is free, you do not have to explain why, and the organization must respond within one calendar month.
The right is in Article 15 of the UK GDPR. It applies to any organization holding your data: your bank, your employer, a data broker, a social platform, a shop with a loyalty scheme. Whatever they have on you, you can ask to see it.
What you can get from a SAR
- -A copy of the personal data they hold about you
- -Why they are using it, and the lawful basis
- -Who they have shared it with
- -How long they will keep it
- -Where they got it, if not from you
For a data broker or people-search site, a SAR is a powerful first move: it reveals exactly what they hold and where they sourced it, which tells you what to challenge or have erased.
How to make a subject access request
- 1.Contact the organization: many have a privacy or data protection contact; if not, any part of the organization will do
- 2.Say clearly that you are making a subject access request under UK GDPR and what you want
- 3.Prove your identity if they reasonably ask, which can pause the clock until you do
- 4.They must respond within one calendar month, free of charge in almost all cases
The request can be verbal or in writing, but writing is better for proof. The ICO has guidance and what to expect at getting a copy of your information ↗.
What changed under the Data (Use and Access) Act
Since early 2026, organizations only have to carry out reasonable and proportionate searches, and can pause the clock while they clarify your request. The core right and the one-month deadline are unchanged.
This is a modest narrowing, not a removal. You still get your data; the organization just is not required to turn over every server to find it. If your request is vague, expect them to ask you to narrow it, which stops the clock until you reply. More on the wider changes in the new right to complain about data use.
If they ignore you or refuse
If an organization misses the one-month deadline or refuses without good reason, complain to the ICO for free.
Raise it with the organization first, then escalate to the ICO at ico.org.uk/make-a-complaint ↗. A SAR pairs naturally with your other rights: once you see what a company holds, you can ask them to delete it. See how to get your data deleted in the UK.
Frequently asked questions
- Is a subject access request free?
- Yes, in almost all cases. An organization can only charge a reasonable fee if your request is manifestly unfounded or excessive, which is uncommon.
- How long does a company have to respond to a SAR?
- One calendar month from your request, or from when you provide any identity verification or clarification they reasonably need. It can extend by up to two months for complex requests, but they must tell you within the first month.
- Can a company refuse my subject access request?
- Only in limited cases, such as where the data is exempt or the request is manifestly excessive. They must explain any refusal and tell you about your right to complain to the ICO.
Sources and further reading
Scott Anderson believes your personal data is yours to own and protect. He built Clearfront, a free, open-source tool for scanning and scrubbing your own digital footprint from public data, and he writes about OSINT, breach exposure, and personal privacy.
Related posts
- How to Get Your Data Deleted in the UK (Erasure and Google Delisting)
UK erasure rights delete your data at source; Google delisting only hides a page from name searches. Here is how each works and why you need both.
- How to Complain About a Company Misusing Your Data (New 2026 UK Right)
From 19 June 2026 you can complain directly to any organization about how it handles your data, and it must acknowledge you within 30 days. Here is how.
- How to Check Your Digital Footprint in the UK (Self-OSINT)
The UK self-audit uses different records than the US one: the electoral register, 192.com, Companies House, the Land Registry. Here is the UK walkthrough.