GetMySAR
How It Works
GetMySAR helps you prepare, submit and follow up a Subject Access Request to an organisation under UK GDPR. This page explains what we do, what happens after submission and the limits of our service.
Last updated: 20 March 2026
On this page
1. What this service is
GetMySAR helps you prepare, submit and follow up a Subject Access Request to an organisation that holds your personal data.
A Subject Access Request itself is usually free under UK GDPR. Our fee is for the service we provide in preparing, submitting and following up the request on your behalf.
This page explains how our service works. It is not legal advice.
2. Standard process
Step 1: Complete the form and pay
Complete our online form with your details, the organisation you want to contact and any supporting information you want us to send.
Once payment is made, we will submit your Subject Access Request to the organisation you name, usually by email and, where available, by SMS.
Step 2: We submit the request
We send the request using the contact details you provide or other contact details we hold for the organisation.
We may ask the organisation to confirm that it has received the request. If it does, we will let you know.
Step 3: We follow up during the response period
If we do not hear back, we may send follow-up reminders during the response period.
If the organisation has still not responded as the deadline approaches, we will send reminder messages before the due date and again on the final day.
3. Deadlines and timing
Under UK GDPR, an organisation usually has one month to respond to a valid Subject Access Request.
In practice, timing can depend on whether the organisation has:
- received the request;
- received enough information to identify you; and
- where reasonably necessary, received proof of identity or authority to act.
If the organisation asks for ID or more information needed to locate your data, that may affect when the response period starts running.
A separate acknowledgement is not always legally required, but a response must usually be given within the applicable timeframe.
4. If the organisation does not respond
If the organisation does not acknowledge or respond to your request within the usual one-month period, we will continue to follow up for up to one further month.
During that time, we may remind the organisation of its obligations under UK GDPR and the Data Protection Act 2018 and ask it to respond without further delay.
If we still cannot obtain a response, we will explain possible next steps, which may include:
- making a complaint to the ICO under Article 77 UK GDPR; and
- considering a court remedy under Article 79 UK GDPR.
At that stage, our service ends.
5. Delays and extensions
In some cases, an organisation may extend the response period by up to two further months.
Under Article 12(3) UK GDPR, an extension should only be used where justified, for example because of the complexity of the request or the number of requests received.
The organisation should tell you within the first month if it needs more time and explain why.
Staff shortages, inconvenience or delay in internal handling alone would not normally justify an extension.
If an extension is claimed, we can continue to send follow-up reminders during the extended period.
6. If the response seems incomplete
Sometimes organisations lawfully redact or withhold information, for example where third-party data, legal privilege or other exemptions apply.
If you believe the response is incomplete or unjustified, you may need to raise this directly with the organisation or complain to the ICO.
Our service is limited to submitting and following up your Subject Access Request. We do not assess whether redactions, exemptions or the substance of a response have been lawfully applied.
7. Scope of this service
GetMySAR is a service for Subject Access Requests only.
We do not help with:
- erasure requests;
- rectification requests;
- restriction requests;
- objection requests;
- data portability requests; or
- legal advice or representation.
8. Important notes
You are responsible for making sure the information you provide is accurate and that you are authorised to act if you are submitting a request for someone else.
We can only send and follow up the request using the information available to us. If the organisation requires further proof of identity, authority or clarification, you may need to provide that directly or through our service workflow.
If you want to understand how we handle your personal data when you use GetMySAR, please read our Privacy Policy.