Subject Access Request (SAR)

The Information Commissioner's Office (ICO) explains that '[t]he right of access, commonly referred to as subject access, gives people the right to obtain a copy of their personal information from you, as well as other supplementary information', helping them 'understand how and why you are using their information and check you are doing so lawfully'. This request is commonly known as a subject access request or SAR. According to the ICO's guidance for organisations, 'people can make SARs verbally or in writing, including via social media', and a third party with appropriate authority — such as a solicitor or relative — can also make one on a person's behalf.

Organisations handling a SAR are subject to firm statutory timescales and duties. The ICO states that 'you must respond without undue delay, and within one month of receipt of the request', though this may be extended by up to two further months for complex or numerous requests. In most circumstances, the ICO confirms that 'in most circumstances, you cannot charge a fee to deal with a request', and that organisations 'must make a reasonable and proportionate search for the requested information' and ensure it is supplied 'clear and accessible' and securely. A SAR can only be refused, in whole or part, if a specific exemption applies — for example where a request is manifestly unfounded or excessive.