How to Make a Data Protection Request

A data protection request is a request to an organisation for the personal data it holds about you. If you have heard the phrases “Data Protection Act request”, “DPA request” or “request under data protection”, they all describe the same thing — and the formal name for it is a subject access request (SAR).

Whatever you call it, the right is the same: you are entitled to ask any organisation — your employer, your bank, the police, a company you dealt with once — whether it holds personal data about you, and to receive a copy of that data along with information about how it is used.

You can make the request yourself, directly to the organisation, for free. No form, fee or legal help is required.

Organisations will treat a “data protection request”, a “DPA request”, a “Data Protection Act request” and a “subject access request” as the same request, because they are. The name does not change what you get: a request is valid if it is clear you are asking for your personal data, however you phrase it.

Using the formal name can help a large organisation route your request to the right team, so it is worth including — but a request that never mentions any Act is just as binding.

For what you get back, what counts as personal data and when a request can be refused, see what is a Subject Access Request.

Two laws work together in the UK. The UK GDPR carries the right of access itself, and the Data Protection Act 2018 sits alongside it, tailoring how it applies and setting out exemptions. When people say “a request under the Data Protection Act”, the right they are using is, in almost every case, the UK GDPR right of access — the two names lead to the same place.

The Data Protection Act 1998, which many people remember making requests under, was replaced in 2018 — the right survived, and the modern version is stronger. One practical difference is worth knowing: information you find about fees or deadlines on older web pages may describe the repealed law, so check anything that looks dated against current guidance.

Requests to the police and law-enforcement bodies work slightly differently — they fall under Part 3 of the DPA 2018 rather than the UK GDPR, though the process for you is much the same. Our police guide covers that route, and our plain-English guide to the UK GDPR covers the law in depth.

In short:

• Send it to the organisation that holds your data — not to a regulator. Its privacy policy usually names the contact; our directory of UK organisations lists verified routes for many.
• Put it in writing, say who you are, and ask for a copy of the personal data held about you — or name the specific records you want.
• Keep a copy and note the date. The deadline runs from receipt.

The full walkthrough — what to include, how to word it, and what has to happen next — is on how to make a GDPR request; the steps are identical because it is the same request.

There is no official or statutory form. Some organisations offer their own online form, and using it is often the fastest route — but an organisation cannot insist on its form, and an email or letter is always valid.

If you want the wording done for you, our free letter generator produces a complete request you can download or email. It is free, with no sign-up, and the letter is yours to use however you send the request.

An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.

Received something but not sure it is complete? Our free SAR response checker will help you judge it.

The request is free to make yourself, and the right is yours either way. Some people prefer to have GetMySAR prepare, submit, track and follow up the request for a service fee of £20 — the fee pays for the administration, not for the right itself, and it does not create any extra legal entitlement.