Subject Access Request Letters
Under GDPR Article 15 and the Data Protection Act 2018, you have the right to request a copy of all personal data any UK organisation holds about you. Equisure Direct drafts Subject Access Request letters that are formally structured and legally referenced.
What we cover
Who this is for
Individuals who need to formally request their personal data from any UK organisation. A correctly structured SAR letter ensures the organisation understands their legal obligations.
Get in touch
Use the chat widget to tell us who you are sending the SAR to and what data you need. We will draft a formally structured letter for you to review and send.
What a Subject Access Request covers
Under UK GDPR you can ask any organisation to tell you whether it holds personal data about you and, if it does, to give you a copy of it along with details of why it holds the data, who it has been shared with and how long it will be kept. This is called a Subject Access Request, usually shortened to SAR.
It is free to make. An organisation can only charge where a request is manifestly unfounded or excessive, which is a high bar and rarely applies to a first request.
The one month deadline
An organisation normally has one calendar month from receiving a valid SAR to respond. It can extend that by up to two further months where a request is complex, but it must tell you it is doing so, and why, within the original month. Silence is not an extension.
Why the wording matters
A vague request invites a narrow answer. Organisations routinely respond to a loosely worded SAR with a single record and treat the matter as closed. A properly scoped request names the periods, the systems and the categories of information in issue, which makes a partial response much harder to justify.
If your request is refused or ignored
Refusals happen, and several of the common grounds do not hold up. If a deadline passes with no reply, or the response is plainly incomplete, the next step is a written challenge to the organisation citing the specific obligation it has not met, and after that a complaint to the Information Commissioner's Office. The ICO is free to complain to.
What we prepare
We draft the request, scoped to what you actually need, and the follow up correspondence where an organisation does not comply. Equisure Direct prepares documents. We are not a law firm and we do not provide legal advice. We cannot guarantee that an organisation will comply, but a precisely worded request is considerably harder to brush aside than a general one.
Read more: what a Subject Access Request is and how to write one.