Subject Access Request (DSAR)
UK GDPR Article 15 request for a copy of your personal data held by an organisation.
This template was not drafted by a solicitor.
It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.
When to use this template
You want to know what personal data an organisation holds about you, why they hold it, who they share it with, and how long they keep it. Free, one calendar month response.
When NOT to use this template
If you only want one specific document and a less formal route would work; the DSAR may be unnecessarily broad and slow. For employment-related DSARs, consider the strategic implications first.
Legal Basis
Article 15 UK GDPR; section 7 Data Protection Act 2018.
Before you send
- Failing to provide ID (controllers can require proof of identity)
- Asking too broadly — the controller can refuse manifestly unfounded or excessive requests
- Missing the 1-month deadline to escalate to the ICO if the controller doesn't respond
Common Mistakes to Avoid
- ✗Failing to provide ID (controllers can require proof of identity)
- ✗Asking too broadly — the controller can refuse manifestly unfounded or excessive requests
- ✗Missing the 1-month deadline to escalate to the ICO if the controller doesn't respond
Build Your Letter
Fill in your details
Complete the fields below. Required fields are marked with *.
Letter preview
[Your Name] [Your Address] [Telephone] [Email] [ORGANISATION NAME] — Data Protection Officer [ORGANISATION ADDRESS] Date: [DATE OF REQUEST] Subject Access Request (Article 15 UK GDPR) Dear Sir or Madam, I am making a subject access request under Article 15 of the UK General Data Protection Regulation and section 7 of the Data Protection Act 2018. 1. My identity Name: [YOUR FULL NAME] Date of birth: [YOUR DATE OF BIRTH] Address: [as above] Customer / employee / account reference (if any): [CUSTOMER/EMPLOYEE/ACCOUNT REFERENCE (IF ANY)] I enclose proof of identity in the form of [PROOF OF IDENTITY ENCLOSED]. 2. What I am requesting Please provide me with a copy of all personal data you hold about me, and the following information: (a) the purposes of processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed; (d) the envisaged period for which the personal data will be stored; (e) the existence of the right to request rectification or erasure or restriction of processing; (f) the right to lodge a complaint with the ICO; (g) where the personal data are not collected from me, any available information as to its source; (h) the existence of automated decision-making, including profiling, and meaningful information about the logic involved. 3. Scope (optional narrowing) [OPTIONAL NARROWING (E.G. SPECIFIC TIMEFRAME OR SYSTEMS)] 4. Time limit and format You must respond within one calendar month of receipt of this request (or one month from receipt of any proof of identity you reasonably require). The response should be provided electronically in a commonly used format unless I have requested otherwise. If you believe my request is manifestly unfounded or excessive, please explain your reasoning before refusing or charging a reasonable fee, so that I can address any concerns. Yours faithfully, [YOUR FULL NAME]
Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.