Data Subject Access Request (DSAR) Letter
Request all personal data held about you by an organisation under UK GDPR Article 15.
When to use this template
Use this letter when you want to know what personal data an organisation holds about you. You have the right to a copy of your personal data, information about how it is processed, and confirmation of the purposes for which it is used. Commonly used before litigation, employment disputes, or when you suspect data has been mishandled.
When NOT to use this template
Do not use this as a general complaints letter. If you want data deleted, use the Right to Erasure template instead. If your primary goal is to obtain documents for litigation, consider whether a court order for disclosure would be more appropriate.
Legal Basis
UK GDPR Article 15 (right of access by the data subject); Data Protection Act 2018; ICO guidance on subject access requests. Organisations must respond within one calendar month and cannot charge a fee for a standard request.
Common Mistakes to Avoid
- ✗Sending to a general email address rather than the Data Protection Officer or designated privacy contact
- ✗Not providing enough identifying information to locate your records
- ✗Expecting the response immediately — the organisation has one calendar month
- ✗Forgetting to ask for information about automated decision-making (Art 15(1)(h)) if relevant
Build Your Letter
Fill in your details
Complete the fields below. Required fields are marked with *.
Optional fields
Letter preview
[YOUR FULL NAME] [YOUR ADDRESS] [YOUR EMAIL ADDRESS] [DATE OF LETTER] Data Protection Officer (or Data Controller) [ORGANISATION NAME] [ORGANISATION ADDRESS] --- Dear Sir or Madam, **DATA SUBJECT ACCESS REQUEST — UK GDPR Article 15** I am writing to exercise my right of access under Article 15 of the UK General Data Protection Regulation (UK GDPR) and Section 45 of the Data Protection Act 2018. **My identity** Full name: [YOUR FULL NAME] Date of birth: [YOUR DATE OF BIRTH] Account/reference number (if known): [ACCOUNT / REFERENCE NUMBER (IF KNOWN)] Email address on file: [YOUR EMAIL ADDRESS] Please treat this letter as a formal data subject access request. **What I am requesting** 1. Confirmation of whether you are processing any personal data relating to me. 2. A copy of all personal data you hold about me, in a commonly used and machine-readable format where possible. 3. The purposes for which my personal data is processed. 4. The categories of personal data concerned. 5. The recipients or categories of recipient to whom my personal data has been or will be disclosed, including recipients in third countries. 6. The envisaged retention period for my personal data, or the criteria used to determine that period. 7. Information about the source of my personal data where it was not collected directly from me. 8. Details of any automated decision-making, including profiling, under Article 22 UK GDPR, the logic involved, and the significance and envisaged consequences of such processing. **Specific data I am particularly interested in** [SPECIFIC DATA CATEGORIES YOU ARE REQUESTING] **Proof of identity** I have enclosed / attach the following by way of proof of identity: [PROOF OF IDENTITY YOU ARE PROVIDING]. **Your obligations** Under UK GDPR Article 12(3), you are required to respond to this request without undue delay and in any event within one calendar month of receipt. You may extend this period by a further two months where the request is complex or numerous, but must inform me of any such extension within the first month, together with the reasons for the delay. You are not entitled to charge a fee for this request unless it is manifestly unfounded or excessive. If you are unsure of my identity, please contact me at the address or email above to request the minimum additional information necessary to confirm who I am. Please do not delay processing my request on this basis without good reason. Yours faithfully, [YOUR FULL NAME]
Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.