Subject Access Request

The ICO's public-facing guidance describes the underlying entitlement in everyday terms: '[y]ou have the right to ask an organisation if they're using or storing your personal information. You can also ask them for copies of your personal information. This is called the right of access and is also known as making a subject access request, a SAR or a DSAR.' Crucially, the ICO stresses that 'anyone can make a SAR' and that a person 'doesn't need a solicitor or a lawyer' to do so — the request can be made informally, for example by email, online form, letter, or even in person, provided it is clear the person is asking for their own personal data.

Once a request is made, the ICO confirms that '[o]rganisations usually have one month to respond to a SAR', and that people are entitled to ask for 'all the information an organisation holds about' them, although this does not guarantee everything will be released, since an organisation can sometimes refuse to provide all or some of the requested information where an exemption applies. The ICO also recommends that a person include identifying details and, where possible, be specific about what they are asking for, since 'this may help you to get the fastest possible reply and more useful information back.' A person can also authorise someone else, such as a relative or representative, to make a subject access request on their behalf, provided that person can prove they have the individual's permission.