Your Right to Access Your Personal Data
Under UK GDPR and the Data Protection Act 2018, every individual has the right to request a copy of any personal data held about them by an organisation. This is called a Subject Access Request, commonly referred to as a SAR.
This right applies to any organisation that processes your personal data — banks, insurers, employers, landlords, solicitors, NHS trusts, local authorities, and any other company or public body that holds information about you.
What Information Can You Request?
A subject access request entitles you to receive:
- Confirmation of whether the organisation holds personal data about you
- A copy of that personal data
- Details of why it is being processed and the legal basis for doing so
- Details of who the data has been shared with
- How long the data will be retained
- Information about any automated decision-making that uses your data
How to Make a Subject Access Request
There is no legally prescribed format for a SAR. You can make one in writing, by email, or verbally — though written is always recommended so you have a record. Your SAR letter should include your full name, date of birth, any account or reference numbers, and a clear statement that you are making a subject access request under UK GDPR.
How Long Does the Organisation Have to Respond?
The organisation must respond within one calendar month of receiving your request. In complex cases they can extend this by a further two months, but they must inform you within the first month.
What If They Refuse or Ignore Your Request?
If an organisation refuses your SAR, fails to respond within the deadline, or provides an incomplete response, you can complain to the ICO — the Information Commissioner’s Office is the UK’s data protection regulator. In some cases you may also be entitled to compensation for distress caused by a breach of your data rights.
Why Subject Access Requests Are Useful in Disputes
A SAR is particularly valuable when you are involved in a dispute. The data held about you — including internal notes, call logs, and correspondence — can form part of your evidence. Requesting this early gives you a clearer picture of what the organisation has recorded and strengthens your position.
Need Help Drafting Your Subject Access Request?
Equisure Direct prepares correctly formatted subject access request letters on your behalf. Request a free review — we will come back to you within one working day.