What is a Subject Access Request?

A Subject Access Request is a formal request under Article 15 of the UK GDPR and section 7 of the Data Protection Act 2018. It allows you to obtain a copy of your personal data held by an organisation, along with details about why it is held, who it is shared with, and how long it is kept.

How long does an organisation have to respond to my request?

The organisation must respond within one calendar month of receiving your request. If they reasonably require proof of identity to verify who you are, the one-month deadline starts from the date they receive that proof. You should escalate to the ICO if they fail to respond within this timeframe.

Can an organisation ask for proof of identity before processing my request?

Yes, organisations can require proof of identity to confirm your identity before processing the request. However, if you fail to provide this proof, they may not be able to proceed. The response deadline only begins once they have received the necessary identification documents.

Can an organisation refuse to handle my Subject Access Request?

An organisation can refuse a request if it is manifestly unfounded or excessive. If they believe this applies, they must explain their reasoning before refusing or charging a reasonable fee. This allows you to address any concerns they have raised regarding the scope of your request.

What format should the response be in?

The response should be provided electronically in a commonly used format unless you specifically request otherwise. The request should include your identity details, a clear statement of what you are asking for, and any optional narrowing of the scope, such as a specific timeframe or system.

← All Templates

Data Protection

Data Protection & Privacy

Updated 2026-05-21

Subject Access Request (DSAR)

UK GDPR Article 15 request for a copy of your personal data held by an organisation.

This template was not drafted by a solicitor.

It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.

When to use this template

You want to know what personal data an organisation holds about you, why they hold it, who they share it with, and how long they keep it. Free, one calendar month response.

When NOT to use this template

If you only want one specific document and a less formal route would work; the DSAR may be unnecessarily broad and slow. For employment-related DSARs, consider the strategic implications first.

Legal Basis

Article 15 UK GDPR; section 7 Data Protection Act 2018.

Before you send

Failing to provide ID (controllers can require proof of identity)
Asking too broadly — the controller can refuse manifestly unfounded or excessive requests
Missing the 1-month deadline to escalate to the ICO if the controller doesn't respond

Common Mistakes to Avoid

✗Failing to provide ID (controllers can require proof of identity)
✗Asking too broadly — the controller can refuse manifestly unfounded or excessive requests
✗Missing the 1-month deadline to escalate to the ICO if the controller doesn't respond

Build Your Letter

Fill in your details

Complete the fields below. Required fields are marked with *.

Date of request*

Organisation name*

Organisation address*

Your full name*

Your date of birth*

Customer/employee/account reference (if any)*

Proof of identity enclosed*

Optional narrowing (e.g. specific timeframe or systems)*

Letter preview

[Your Name]
[Your Address]
[Telephone] [Email]

[ORGANISATION NAME] — Data Protection Officer
[ORGANISATION ADDRESS]

Date: [DATE OF REQUEST]

Subject Access Request (Article 15 UK GDPR)

Dear Sir or Madam,

I am making a subject access request under Article 15 of the UK General Data Protection Regulation and section 7 of the Data Protection Act 2018.

1. My identity

Name: [YOUR FULL NAME]
Date of birth: [YOUR DATE OF BIRTH]
Address: [as above]
Customer / employee / account reference (if any): [CUSTOMER/EMPLOYEE/ACCOUNT REFERENCE (IF ANY)]

I enclose proof of identity in the form of [PROOF OF IDENTITY ENCLOSED].

2. What I am requesting

Please provide me with a copy of all personal data you hold about me, and the following information:

(a) the purposes of processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed;
(d) the envisaged period for which the personal data will be stored;
(e) the existence of the right to request rectification or erasure or restriction of processing;
(f) the right to lodge a complaint with the ICO;
(g) where the personal data are not collected from me, any available information as to its source;
(h) the existence of automated decision-making, including profiling, and meaningful information about the logic involved.

3. Scope (optional narrowing)

[OPTIONAL NARROWING (E.G. SPECIFIC TIMEFRAME OR SYSTEMS)]

4. Time limit and format

You must respond within one calendar month of receipt of this request (or one month from receipt of any proof of identity you reasonably require). The response should be provided electronically in a commonly used format unless I have requested otherwise.

If you believe my request is manifestly unfounded or excessive, please explain your reasoning before refusing or charging a reasonable fee, so that I can address any concerns.

Yours faithfully,

[YOUR FULL NAME]

Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.

Official Resources

ICO — Right of access →Article 15 UK GDPR →

Frequently asked questions

What is a Subject Access Request?: A Subject Access Request is a formal request under Article 15 of the UK GDPR and section 7 of the Data Protection Act 2018. It allows you to obtain a copy of your personal data held by an organisation, along with details about why it is held, who it is shared with, and how long it is kept.
How long does an organisation have to respond to my request?: The organisation must respond within one calendar month of receiving your request. If they reasonably require proof of identity to verify who you are, the one-month deadline starts from the date they receive that proof. You should escalate to the ICO if they fail to respond within this timeframe.
Can an organisation ask for proof of identity before processing my request?: Yes, organisations can require proof of identity to confirm your identity before processing the request. However, if you fail to provide this proof, they may not be able to proceed. The response deadline only begins once they have received the necessary identification documents.
Can an organisation refuse to handle my Subject Access Request?: An organisation can refuse a request if it is manifestly unfounded or excessive. If they believe this applies, they must explain their reasoning before refusing or charging a reasonable fee. This allows you to address any concerns they have raised regarding the scope of your request.
What format should the response be in?: The response should be provided electronically in a commonly used format unless you specifically request otherwise. The request should include your identity details, a clear statement of what you are asking for, and any optional narrowing of the scope, such as a specific timeframe or system.