How long does an organisation have to respond to my request?

Organisations must respond to a standard Data Subject Access Request within one calendar month of receipt. They cannot charge a fee unless the request is manifestly unfounded or excessive. If the request is complex or numerous, the organisation may extend this period by a further two months, but they must inform you of this extension within the first month.

Who should I send the letter to and what details do I need to include?

You should send the letter to the Data Protection Officer or the designated privacy contact at the organisation. Sending it to a general email address is a common mistake that can cause delays. You must also provide enough identifying information, such as your name, date of birth, and any account reference numbers, to help them locate your records.

Can I use this letter to ask for my data to be deleted?

If you want your data deleted, you should use a Right to Erasure template instead of a Data Subject Access Request. A DSAR is specifically for accessing and reviewing the data an organisation holds about you, not for requesting its removal. Using the wrong template may not achieve your desired outcome.

What specific information must I include in the body of the letter?

The letter should include your full name, address, email, date of birth, and any known account or reference numbers. You must also specify exactly what data you are requesting, such as confirmation of processing, a copy of the data, purposes of processing, categories of data, recipients, retention periods, and data sources. You should also enclose proof of identity.

← All Templates

Data Protection

Data Protection Law

Updated 2026-04-17

Data Subject Access Request (DSAR) Letter

Request all personal data held about you by an organisation under UK GDPR Article 15.

This template was not drafted by a solicitor.

It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.

When to use this template

Use this letter when you want to know what personal data an organisation holds about you. You have the right to a copy of your personal data, information about how it is processed, and confirmation of the purposes for which it is used. Commonly used before litigation, employment disputes, or when you suspect data has been mishandled.

When NOT to use this template

Do not use this as a general complaints letter. If you want data deleted, use the Right to Erasure template instead. If your primary goal is to obtain documents for litigation, consider whether a court order for disclosure would be more appropriate.

Legal Basis

UK GDPR Article 15 (right of access by the data subject); Data Protection Act 2018; ICO guidance on subject access requests. Organisations must respond within one calendar month and cannot charge a fee for a standard request.

Before you send

Sending to a general email address rather than the Data Protection Officer or designated privacy contact
Not providing enough identifying information to locate your records
Expecting the response immediately — the organisation has one calendar month

Common Mistakes to Avoid

✗Sending to a general email address rather than the Data Protection Officer or designated privacy contact
✗Not providing enough identifying information to locate your records
✗Expecting the response immediately — the organisation has one calendar month
✗Forgetting to ask for information about automated decision-making (Art 15(1)(h)) if relevant

Build Your Letter

Fill in your details

Complete the fields below. Required fields are marked with *.

Your full name*

Your address*

Your email address*

Date of letter*

Organisation name*

Organisation address*

Your date of birth*

Optional fields

Account / reference number (if known)

Specific data categories you are requesting

Proof of identity you are providing

Letter preview

[YOUR FULL NAME]
[YOUR ADDRESS]
[YOUR EMAIL ADDRESS]

[DATE OF LETTER]

Data Protection Officer (or Data Controller)
[ORGANISATION NAME]
[ORGANISATION ADDRESS]

---

Dear Sir or Madam,

**DATA SUBJECT ACCESS REQUEST — UK GDPR Article 15**

I am writing to exercise my right of access under Article 15 of the UK General Data Protection Regulation (UK GDPR) and Section 45 of the Data Protection Act 2018.

**My identity**

Full name: [YOUR FULL NAME]
Date of birth: [YOUR DATE OF BIRTH]
Account/reference number (if known): [ACCOUNT / REFERENCE NUMBER (IF KNOWN)]
Email address on file: [YOUR EMAIL ADDRESS]

Please treat this letter as a formal data subject access request.

**What I am requesting**

1. Confirmation of whether you are processing any personal data relating to me.
2. A copy of all personal data you hold about me, in a commonly used and machine-readable format where possible.
3. The purposes for which my personal data is processed.
4. The categories of personal data concerned.
5. The recipients or categories of recipient to whom my personal data has been or will be disclosed, including recipients in third countries.
6. The envisaged retention period for my personal data, or the criteria used to determine that period.
7. Information about the source of my personal data where it was not collected directly from me.
8. Details of any automated decision-making, including profiling, under Article 22 UK GDPR, the logic involved, and the significance and envisaged consequences of such processing.

**Specific data I am particularly interested in**

[SPECIFIC DATA CATEGORIES YOU ARE REQUESTING]

**Proof of identity**

I have enclosed / attach the following by way of proof of identity: [PROOF OF IDENTITY YOU ARE PROVIDING].

**Your obligations**

Under UK GDPR Article 12(3), you are required to respond to this request without undue delay and in any event within one calendar month of receipt. You may extend this period by a further two months where the request is complex or numerous, but must inform me of any such extension within the first month, together with the reasons for the delay.

You are not entitled to charge a fee for this request unless it is manifestly unfounded or excessive.

If you are unsure of my identity, please contact me at the address or email above to request the minimum additional information necessary to confirm who I am. Please do not delay processing my request on this basis without good reason.

Yours faithfully,

[YOUR FULL NAME]

Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.

Related Guides

Making A Dsar

Related Rights

Online Rights

Official Resources

ICO — Subject Access Requests →ICO — Make a Complaint →

Frequently asked questions

When should I use a Data Subject Access Request letter?: You can use this letter to request a copy of your personal data, details on how it is processed, and the purposes for its use. It is commonly used before litigation, in employment disputes, or when you suspect data has been mishandled. Do not use it as a general complaints letter or if your primary goal is to obtain documents for litigation, where a court order might be more appropriate.
How long does an organisation have to respond to my request?: Organisations must respond to a standard Data Subject Access Request within one calendar month of receipt. They cannot charge a fee unless the request is manifestly unfounded or excessive. If the request is complex or numerous, the organisation may extend this period by a further two months, but they must inform you of this extension within the first month.
Who should I send the letter to and what details do I need to include?: You should send the letter to the Data Protection Officer or the designated privacy contact at the organisation. Sending it to a general email address is a common mistake that can cause delays. You must also provide enough identifying information, such as your name, date of birth, and any account reference numbers, to help them locate your records.
Do I need to ask about automated decision-making in my letter?: Yes, you should specifically ask for details of any automated decision-making, including profiling, under Article 22 UK GDPR. This includes the logic involved and the significance and envisaged consequences of such processing. Forgetting to include this request is a common oversight if automated decisions are relevant to your situation.
Can I use this letter to ask for my data to be deleted?: If you want your data deleted, you should use a Right to Erasure template instead of a Data Subject Access Request. A DSAR is specifically for accessing and reviewing the data an organisation holds about you, not for requesting its removal. Using the wrong template may not achieve your desired outcome.
What specific information must I include in the body of the letter?: The letter should include your full name, address, email, date of birth, and any known account or reference numbers. You must also specify exactly what data you are requesting, such as confirmation of processing, a copy of the data, purposes of processing, categories of data, recipients, retention periods, and data sources. You should also enclose proof of identity.