Subject Access Request to the Solicitors Regulation Authority

The SRA regulates solicitors and most law firms in England and Wales, so a subject access request to it gets you the SRA's own file about you: most often the complaint file it opens when someone reports a solicitor or a firm, or its records about you if you are a solicitor it has dealt with. The file your own solicitor holds belongs to the firm, and a request for that goes to the firm. Write to SRA Information Compliance at the Birmingham address above. The SRA's privacy notice says you can email or post a request, but its "Email or post it to us" link goes to the general contact page, and that page publishes no email address at all. The one mailbox the SRA publishes for information rights, SRAInformationCompliance@sra.org.uk, appears on its Freedom of Information form and in the part of its notice about reporting concerns over how it processes data — and that FOI form sends anyone asking for their own personal information back to the privacy notice. Post is the route with a published destination, and a request is valid however you make it: a letter covering the same details is enough. The SRA still publishes a subject access request form, but it is Version 3 of May 2018, the current privacy notice does not link it, and it says the one-month period does not start until proof of identity has arrived. The notice takes a different line, saying identity is often obvious from previous engagement. The SRA also asks you not to send original documents unless it has specifically requested them. The SRA says it will normally answer within one month of a valid request, and that complex or numerous requests may take up to three months. Expect part of the file to be held back: it names information that is also someone else's personal data, disclosure that would prejudice its regulatory functions — for example by making an investigation difficult — and material subject to legal privilege, and it says it will explain in its response where an exemption applies. If you reported a solicitor, the SRA may have to disclose your details to the person or firm you complained about. It says it will try to respect a request not to be identified, but that where it is unable to progress a complaint and there is an overriding need to protect the public it may decide to disclose your identity. A subject access request gets you records; it does not get anything put right. Poor service goes to the firm first and then to the Legal Ombudsman, which the SRA says is best placed to help because it cannot make a solicitor apologise or pay you compensation. Serious misconduct or dishonesty is a report to the SRA on its own form, and it says there is no time limit for reporting concerns and that it can take up to eight weeks to decide whether to investigate. Money a firm owes you is an application to the SRA Compensation Fund, which the SRA describes as a discretionary fund where no one is entitled to a payment. A solicitor's data breach, it says, is usually best reported to the Information Commissioner's Office rather than to the SRA. The SRA is a separate organisation from the Law Society. Solicitors Regulation Authority Limited is a company limited by guarantee, company registration number 12608059, wholly owned by the Law Society of England and Wales but operating separately as the Legal Services Act 2007 requires. The Law Society is its own controller at 113 Chancery Lane in London and has a confusingly similar mailbox, so check which organisation you mean before you write. The SRA publishes nothing about the records of someone who has died, and data protection rights end at death, so a subject access request is not the route for another person's records.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.