Free Subject Access Request Template

Yes. SAR means subject access request, while DSAR means data subject access request. In practice, “SAR request template”, “SAR letter template” and “DSAR template” usually describe the same thing: wording an individual can send to an organisation to request their personal data.

This template is designed for requests under UK data protection law. It produces a complete letter that you can edit before sending it by email or post.

You do not need special legal wording to write a subject access request. A request is valid as soon as it is clear you are asking for your own personal data. The Information Commissioner’s Office is explicit that you do not need to use a particular form of words, do not need to mention any legislation, and do not need to send it to a particular person or department. You can make one verbally, or in writing, or through a form on the organisation’s website.

So the letter above is not doing anything magic. What it does is include the things that make a response arrive faster and more complete, which the ICO suggests putting in:

• a heading that says subject access request, so it reaches the right team rather than sitting in a general inbox;
• the date you made it, which starts the clock;
• your name, including any name you used before, and enough contact detail to identify you;
• account, customer or reference numbers — the fastest way for them to find you in a system;
• what you actually want — and, where it helps, what you do not want;
• dates, branches, departments or names that narrow the search; and
• how you would like to receive the reply, and any accessibility requirements.

The one thing most templates leave out is the supplementary information — why they are using your data, who they have shared it with, how long they will keep it, where they got it, and whether it feeds any automated decision-making. That is part of the same right, it is often the most revealing part of the answer, and it is in the letter above as standard.

You are entitled to. Asking for “all the personal data you hold about me” is a perfectly valid request and the letter will say exactly that if you choose it.

But it is usually not the fastest way to get the thing you actually wanted. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

A practical middle course: ask for the specific records you care about, name the dates and the department, and add that you would also like anything else held about you. You get the useful material early rather than waiting for a large disclosure you then have to read through.

How long they have. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

What it costs. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Identity. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.

Keep a copy of the letter and a note of the date you sent it. If you submitted it through a website form, screenshot it before you press send — that record is the only evidence of when the month started.

When the response arrives. A reply that hands over documents but says nothing about purposes, recipients, retention or sources has answered half the request. Our free subject access request response checker works through what should have been included and drafts a follow-up letter for anything missing.