Making a Data Subject Access Request (DSAR)
UK GDPR Article 15 lets you ask any organisation holding your personal data — an employer, bank, NHS trust, social media platform — for a free copy of it, known as a Subject Access Request (SAR) or DSAR. The organisation has one month to respond, extendable by two further months for complex or high-volume requests. Since 5 February 2026 this deadline is set out expressly in law rather than left to guidance.
Overview
A Data Subject Access Request is made under Article 15 of the UK GDPR against whichever organisation controls your data — you do not need to name the legislation or use a specific form, and a request is free unless it is manifestly unfounded or excessive. Since 5 February 2026, section 76 of the Data (Use and Access) Act 2025 has fixed how the response deadline works: a new Article 12A of the UK GDPR (mirrored in section 54 of the 2018 Act) sets the 'applicable time period' at one month, running from the request, the fee (if any), or identifying information supplied by you, whichever is latest. The controller can extend this by two further months where the complexity or number of your requests makes that necessary, but must notify you before the first month ends and explain the delay. If the organisation reasonably needs further information to identify what you are looking for, the clock pauses while you provide it. Most organisations resolve requests well inside the deadline; if yours does not, or refuses without a recognised exemption, the Information Commissioner's Office can investigate free of charge.
Who Can Use This Process
- You are the data subject (the person the data is about) or authorised to act on their behalf
- The request is for personal data — information that identifies or relates to you
- The request is made to the data controller (the organisation that decides how your data is used)
Step-by-Step Process
Identify the organisation
Determine which organisation holds your data. Check their privacy policy for the data controller's details and any specific SAR process they have. Large organisations may have a dedicated Data Protection Officer (DPO) or SAR email address.
- Check the organisation's privacy policy for their DPO contact details
- You can make a SAR to any organisation — employer, bank, social media platform, NHS trust, etc.
Submit your request
Write to the organisation stating you are making a Subject Access Request under Article 15 UK GDPR. You do not need to use any specific form — a letter or email is sufficient. Be as specific as possible about what data you want (though you have the right to request all data). Include enough information for them to verify your identity.
- You do not need to give a reason for your request
- Keep a copy of your request and note the date — the clock starts on receipt
- You can make the request verbally, but written requests create a clear record
Provide ID if requested
The organisation may ask you to verify your identity before releasing data. This is reasonable — but they must not use ID verification as a way to delay or obstruct the request. Provide the minimum necessary (e.g., a copy of your driving licence or passport).
- Redact unnecessary information from ID documents (e.g., your passport number if only your name and photo are needed)
Receive the response
The organisation must respond within one calendar month. They must provide: a copy of your personal data, information about the purposes of processing, the categories of data, recipients, retention periods, and your rights. The response must be in a commonly used electronic format if you made the request electronically.
- The one-month deadline can be extended by two further months for complex or numerous requests — but they must tell you within the first month
- The response must be free of charge (unless manifestly unfounded or excessive)
Complain to the ICO if not satisfied
If the organisation fails to respond, refuses your request without valid reason, or provides an incomplete response, you can complain to the Information Commissioner's Office (ICO). The ICO can investigate and order compliance.
- The ICO expects you to have raised the issue with the organisation first
- You also have the right to bring a claim in court for compensation if you have suffered damage
Costs
Important Warnings
Organisations may refuse if your request is 'manifestly unfounded or excessive' — but the bar for this is high.
Some data may be exempt from disclosure, e.g., information subject to legal professional privilege or data that would reveal information about another person.
If you need data urgently (e.g., for court proceedings), explain the urgency — the organisation should prioritise.
Useful Links
Frequently asked questions
- How long does the making a data subject access request (dsar) process take?
- The end-to-end timeline depends on which stage you're at. Common steps run on these timeframes: "Immediate"; "Day 1"; "Within a few days of request"; "Within 1 month". Add court / counterparty response time on top — disputed matters can run months longer than the bare minimum.
- How much does it cost?
- Main outlays are: Making a DSAR — Free; ICO complaint — Free. Court fees often qualify for Help with Fees remission if you're on a low income. Solicitor fees are extra and vary widely — many matters can be done as a litigant in person.
- What are the most common mistakes to avoid?
- Watch out for: Organisations may refuse if your request is 'manifestly unfounded or excessive' — but the bar for this is high.; Some data may be exempt from disclosure, e.g., information subject to legal professional privilege or data that would reveal information about another person.; If you need data urgently (e.g., for court proceedings), explain the urgency — the organisation should prioritise.. If you're unsure on any of these, get advice from a regulated solicitor or a free service like Citizens Advice before acting.
- Where can I find the official forms and guidance?
- The official sources are: ICO — Your right of access; ICO — Make a complaint. Always use the forms / guidance from the issuing authority's own site — third-party copies can be out of date.
- Can I do this myself without a solicitor?
- Yes — many people complete this kind of matter as a litigant in person. The site walks through each step in plain English. A solicitor is recommended if: large sums are at stake, the other side has legal representation, the matter involves criminal liability, children, immigration, or you're unsure on any procedural deadline. Free advice is available from Citizens Advice, Law Centres, and (for some matters) LawWorks pro bono clinics.
Part of our Online Harm, Privacy and Reputation hub
Defamation, harassment, data protection, Online Safety Act, and intimate image abuse — civil and criminal routes.