A Subject Access Request (SAR) is a formal letter that enables an individual — known as the data subject — to exercise their statutory right under Article 15 of the UK General Data Protection Regulation (UK GDPR) and Section 45 of the Data Protection Act 2018 to obtain copies of personal data held about them by any organisation, together with detailed supplementary information about how that data is being processed. Following the United Kingdom's exit from the European Union, the EU's General Data Protection Regulation was retained in domestic law under the European Union (Withdrawal) Act 2018 and modified by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, creating the UK GDPR as a standalone domestic instrument that applies across England, Wales, Scotland, and Northern Ireland.

The right to access personal data is one of the most fundamental rights conferred by UK data protection law. It enables individuals to verify whether their personal data is being lawfully processed, to identify inaccuracies, to understand who it has been shared with, to check how long it will be retained, and to assess whether they have grounds to exercise other rights such as the right to rectification (Article 16), the right to erasure (Article 17), or the right to object to processing (Article 21).

A Subject Access Request can be submitted to any organisation acting as a data controller — that is, any entity that determines the purposes and means of processing personal data. This includes private sector companies, public authorities, employers, NHS trusts, financial institutions, insurers, retailers, social media platforms, and any other body holding personal data. The SAR can be submitted in writing by letter or email, and there is no prescribed format — though a well-drafted formal letter that cites the specific statutory provisions is more likely to receive a prompt and substantive response.

Organisations must respond within one calendar month of receiving the request, at no charge, unless the request is manifestly unfounded or excessive. The Information Commissioner's Office (ICO) — the UK's independent data protection regulator — enforces compliance and can receive complaints from individuals whose rights are not respected.

A Subject Access Request is appropriate in a wide range of circumstances involving personal data held by organisations in the United Kingdom. The most common situations in which individuals submit SARs include employment disputes, consumer rights matters, healthcare queries, financial services, and general privacy concerns.

In the employment context, SARs are frequently submitted by employees or former employees who wish to review data held about them by a current or former employer — including performance records, disciplinary files, sickness records, emails, correspondence, and notes from meetings. An employee who has been dismissed, placed under a performance improvement plan, or subject to a disciplinary investigation may use a SAR to obtain documentary evidence of the decisions made and the personal data held about them, which can be relevant in employment tribunal proceedings. The subject access right applies equally to job applicants who wish to understand what data was recorded during a recruitment process.

In consumer matters, SARs are commonly used to obtain data from banks, credit reference agencies, insurers, and retailers. A borrower who has been refused a mortgage may wish to review the data held about them by a lender. A customer involved in a dispute with a company may wish to obtain copies of call recordings, emails, or notes of conversations. Under the Consumer Rights Act 2015 and the Financial Services and Markets Act 2000 (as amended), consumers in the UK have various rights that can be informed and supported by the data obtained through a SAR.

SARs are also valuable in healthcare contexts. Patients are entitled to access their NHS and private medical records under the UK GDPR. A SAR to an NHS trust, GP surgery, hospital, or private healthcare provider will typically yield copies of clinical notes, test results, correspondence between healthcare professionals, and other records held on the patient's file. This can be important for medical negligence claims, second opinions, or understanding a diagnosis.

In legal proceedings, SARs can be a cost-effective pre-litigation tool for gathering evidence. The data obtained through a SAR may reveal information that supports or informs a claim, and may also assist in identifying potential witnesses or understanding the timeline of events. Solicitors in England and Wales regularly advise clients to submit SARs as part of pre-action investigation, particularly in employment disputes, data protection claims, and professional negligence matters.

A well-drafted Subject Access Request letter should contain several key elements to ensure it is effective, legally compliant, and likely to receive a comprehensive response from the organisation.

The letter must clearly identify the data subject — the individual making the request — with their full legal name, contact address, and any reference or account numbers held by the organisation. Providing identification information is important because the organisation is entitled to verify the identity of the person making the request before disclosing personal data to them. Under Article 12(6) of the UK GDPR, where an organisation has reasonable doubts about the identity of the individual, they may request additional information necessary to confirm identity — but they cannot demand disproportionate proof.

The letter should explicitly identify the legal basis for the request by citing Article 15 of the UK GDPR and Section 45 of the Data Protection Act 2018. This immediately signals to the organisation and its Data Protection Officer that the requester is aware of their legal rights, and makes it harder for the organisation to treat the request as an informal query rather than a formal statutory exercise.

The scope of the request should be clearly defined. The requester may request all personal data held about them, or may narrow the scope to a particular time period, category of data, or department. Being specific can make the organisation's response more focused and easier to analyse, and can reduce the volume of irrelevant information received. However, a broad request covering all personal data is equally valid.

The supplementary information requested under Article 15(1) should be stated explicitly — including the purposes and legal bases for processing, the categories of data held, recipients of the data, retention periods, and automated decision-making. These elements are often omitted from SAR responses by organisations that respond hastily, so requesting them explicitly at the outset ensures they must be addressed.

The preferred response format should be stated. Under Article 15(3) UK GDPR, the copy of personal data must be provided in a commonly used electronic format where the request is made electronically. The letter should also state the one-month response deadline and the requester's right to complain to the ICO and to seek a court order if the organisation fails to comply. Including these references signals that the requester understands the enforcement mechanisms available and is serious about exercising their rights.