Subject Access Request (UK)

A Subject Access Request in the United Kingdom makes a formal application or declaration to the relevant authority and sets out the particulars it requires to decide or record the matter, and takes its legal force from UK GDPR and Data Protection Act 2018.

The right to access personal data is one of the most fundamental rights conferred by UK data protection law. It enables individuals to verify whether their personal data is being lawfully processed, to identify inaccuracies, to understand who it has been shared with, to check how long it will be retained, and to assess whether they have grounds to exercise other rights such as the right to rectification (Article 16), the right to erasure (Article 17), or the right to object to processing (Article 21).

A Subject Access Request can be submitted to any organisation acting as a data controller — that is, any entity that determines the purposes and means of processing personal data. This includes private sector companies, public authorities, employers, NHS trusts, financial institutions, insurers, retailers, social media platforms, and any other body holding personal data. The SAR can be submitted in writing by letter or email, and there is no prescribed format — though a well-drafted formal letter that cites the specific statutory provisions is more likely to receive a prompt and substantive response.

Organisations must respond within one calendar month of receiving the request, at no charge, unless the request is manifestly unfounded or excessive. The Information Commissioner's Office (ICO) — the UK's independent data protection regulator — enforces compliance and can receive complaints from individuals whose rights are not respected.

The legal framework governing the Subject Access Request (UK) in United Kingdom draws on several key statutes and regulatory bodies. Under UK law, the UK GDPR and Data Protection Act 2018 govern personal data in this document. The Consumer Rights Act 2015 protects individuals in consumer transactions. Section 62 of the Consumer Rights Act 2015 addresses unfair terms. The County Court and High Court of Justice have jurisdiction over personal disputes under the Senior Courts Act 1981 and the County Courts Act 1984. The Information Commissioner's Office (ICO) enforces data protection. Parties executing a Subject Access Request (UK) in United Kingdom should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Consumer Rights Act 2015 sets the foundational requirements.

A Subject Access Request is appropriate in a wide range of circumstances involving personal data held by organisations in the United Kingdom. The most common situations in which individuals submit SARs include employment disputes, consumer rights matters, healthcare queries, financial services, and general privacy concerns.

In the employment context, SARs are frequently submitted by employees or former employees who wish to review data held about them by a current or former employer — including performance records, disciplinary files, sickness records, emails, correspondence, and notes from meetings. An employee who has been dismissed, placed under a performance improvement plan, or subject to a disciplinary investigation may use a SAR to obtain documentary evidence of the decisions made and the personal data held about them, which can be relevant in employment tribunal proceedings. The subject access right applies equally to job applicants who wish to understand what data was recorded during a recruitment process.

In consumer matters, SARs are commonly used to obtain data from banks, credit reference agencies, insurers, and retailers. A borrower who has been refused a mortgage may wish to review the data held about them by a lender. A customer involved in a dispute with a company may wish to obtain copies of call recordings, emails, or notes of conversations. Under the Consumer Rights Act 2015 and the Financial Services and Markets Act 2000 (as amended), consumers in the UK have various rights that can be informed and supported by the data obtained through a SAR.

SARs are also valuable in healthcare contexts. Patients are entitled to access their NHS and private medical records under the UK GDPR. A SAR to an NHS trust, GP surgery, hospital, or private healthcare provider will typically yield copies of clinical notes, test results, correspondence between healthcare professionals, and other records held on the patient's file. This can be important for medical negligence claims, second opinions, or understanding a diagnosis.

In legal proceedings, SARs can be a cost-effective pre-litigation tool for gathering evidence. The data obtained through a SAR may reveal information that supports or informs a claim, and may also assist in identifying potential witnesses or understanding the timeline of events. Solicitors in England and Wales regularly advise clients to submit SARs as part of pre-action investigation, particularly in employment disputes, data protection claims, and professional negligence matters.

A well-drafted Subject Access Request letter should contain several key elements to confirm it is effective, legally compliant, and likely to receive a thorough response from the organisation.

The letter must clearly identify the data subject — the individual making the request — with their full legal name, contact address, and any reference or account numbers held by the organisation. Providing identification information is important because the organisation is entitled to verify the identity of the person making the request before disclosing personal data to them. Under Article 12(6) of the UK GDPR, where an organisation has reasonable doubts about the identity of the individual, they may request additional information necessary to confirm identity — but they cannot demand disproportionate proof.

The letter should explicitly identify the legal basis for the request by citing Article 15 of the UK GDPR and Section 45 of the Data Protection Act 2018. This immediately signals to the organisation and its Data Protection Officer that the requester is aware of their legal rights, and makes it harder for the organisation to treat the request as an informal query rather than a formal statutory exercise.

The scope of the request should be clearly defined. The requester may request all personal data held about them, or may narrow the scope to a particular time period, category of data, or department. Being specific can make the organisation's response more focused and easier to analyse, and can reduce the volume of irrelevant information received. However, a broad request covering all personal data is equally valid.

The supplementary information requested under Article 15(1) should be stated explicitly — including the purposes and legal bases for processing, the categories of data held, recipients of the data, retention periods, and automated decision-making. These elements are often omitted from SAR responses by organisations that respond hastily, so requesting them explicitly at the outset confirms they must be addressed.

The preferred response format should be stated. Under Article 15(3) UK GDPR, the copy of personal data must be provided in a commonly used electronic format where the request is made electronically. The letter should also state the one-month response deadline and the requester's right to complain to the ICO and to seek a court order if the organisation fails to comply. Including these references signals that the requester understands the enforcement mechanisms available and is serious about exercising their rights.

Additional compliance elements for a Subject Access Request (UK) used in United Kingdom include: Under UK law, the UK GDPR and Data Protection Act 2018 govern personal data in this document. The Consumer Rights Act 2015 protects individuals in consumer transactions. Section 62 of the Consumer Rights Act 2015 addresses unfair terms. The County Court and High Court of Justice have jurisdiction over personal disputes under the Senior Courts Act 1981 and the County Courts Act 1984. The Information Commissioner's Office (ICO) enforces data protection. Forms-legal.com provides this template as a starting point for United Kingdom-compliant documentation.