How long does the making a data subject access request (dsar) process take?

The end-to-end timeline depends on which stage you're at. Common steps run on these timeframes: "Day 1"; "Up to 1 month (3 months if complex)"; "At any point after non-compliance". Add court / counterparty response time on top — disputed matters can run months longer than the bare minimum.

How much does it cost?

Main outlays are: DSAR fee — Free; ICO complaint — Free. Court fees often qualify for Help with Fees remission if you're on a low income. Solicitor fees are extra and vary widely — many matters can be done as a litigant in person.

Where can I find the official forms and guidance?

The official sources are: ICO — Your Right of Access; ICO — Make a Complaint. Always use the forms / guidance from the issuing authority's own site — third-party copies can be out of date.

Can I do this myself without a solicitor?

Yes — many people complete this kind of matter as a litigant in person. The site walks through each step in plain English. A solicitor is recommended if: large sums are at stake, the other side has legal representation, the matter involves criminal liability, children, immigration, or you're unsure on any procedural deadline. Free advice is available from Citizens Advice, Law Centres, and (for some matters) LawWorks pro bono clinics.

All Guides

Data Protection

5 steps

Updated March 2026

UK-wide

Making a Data Subject Access Request (DSAR)

How to request a copy of the personal data an organisation holds about you under the UK GDPR.

This page covers UK-wide law. Where local procedure differs (e.g. courts or tribunals), this is noted in the relevant section.

Overview

Under Article 15 of the UK GDPR, you have the right to obtain confirmation of whether an organisation is processing your personal data and, if so, to receive a copy of that data. This is known as a Subject Access Request (SAR) or Data Subject Access Request (DSAR). Organisations must respond within one calendar month. The request is free.

Who Can Use This Process

You are likely eligible to use this guide if your situation involves a data subject access request (dsar).
You have a genuine legal basis for the matter (contract, tort, statutory right, etc.).
You have made reasonable attempts to resolve the matter directly with the other party first.

Step-by-Step Process

Identify the Organisation

Determine which organisation holds your data. This could be your employer, bank, GP, school, social media platform, or any organisation that processes your personal data.

Write Your Request

Send a written request (email or letter) asking for a copy of all personal data held about you. You do not need to use any specific form or mention the UK GDPR, but it helps to be clear. Include enough information to identify yourself (name, account number, etc.).

Timeframe: Day 1

Organisation Must Respond

The organisation must respond within one calendar month of receiving your request. They can extend this by two further months for complex requests, but must tell you within the first month.

Timeframe: Up to 1 month (3 months if complex)

Review the Response

Check the data provided is complete. You should receive a copy of your personal data, information about the purposes of processing, who the data has been shared with, and how long it will be kept.

Complain to the ICO if Unsatisfied

If the organisation fails to respond, provides an incomplete response, or refuses without valid reason, you can complain to the Information Commissioner's Office (ICO) for free.

Timeframe: At any point after non-compliance

Costs

DSAR feeFree

ICO complaintFree

Important Warnings

Organisations can refuse or charge a reasonable fee for requests that are 'manifestly unfounded or excessive'.

Some data may be exempt from disclosure (e.g., legal professional privilege, crime prevention).

Useful Links

ICO — Your Right of Access ICO — Make a Complaint

Frequently asked questions

How long does the making a data subject access request (dsar) process take?: The end-to-end timeline depends on which stage you're at. Common steps run on these timeframes: "Day 1"; "Up to 1 month (3 months if complex)"; "At any point after non-compliance". Add court / counterparty response time on top — disputed matters can run months longer than the bare minimum.
How much does it cost?: Main outlays are: DSAR fee — Free; ICO complaint — Free. Court fees often qualify for Help with Fees remission if you're on a low income. Solicitor fees are extra and vary widely — many matters can be done as a litigant in person.
What are the most common mistakes to avoid?: Watch out for: Organisations can refuse or charge a reasonable fee for requests that are 'manifestly unfounded or excessive'.; Some data may be exempt from disclosure (e.g., legal professional privilege, crime prevention).. If you're unsure on any of these, get advice from a regulated solicitor or a free service like Citizens Advice before acting.
Where can I find the official forms and guidance?: The official sources are: ICO — Your Right of Access; ICO — Make a Complaint. Always use the forms / guidance from the issuing authority's own site — third-party copies can be out of date.
Can I do this myself without a solicitor?: Yes — many people complete this kind of matter as a litigant in person. The site walks through each step in plain English. A solicitor is recommended if: large sums are at stake, the other side has legal representation, the matter involves criminal liability, children, immigration, or you're unsure on any procedural deadline. Free advice is available from Citizens Advice, Law Centres, and (for some matters) LawWorks pro bono clinics.

Part of our Online Harm, Privacy and Reputation hub

Defamation, harassment, data protection, Online Safety Act, and intimate image abuse — civil and criminal routes.