What Is a Subject Access Request (SAR)?

A Subject Access Request, usually shortened to SAR, is the legal right that lets you ask an organisation for a copy of the personal data it holds about you.

Under Article 15 UK GDPR, you can ask a data controller to confirm whether it is processing your personal data and, if it is, to give you access to that data and important information about how it is being used.

The ICO also calls this the right of access. It exists to help people understand how and why organisations use their information and to check that the processing is lawful, fair and transparent.

This sits within the wider data protection framework set out by the UK GDPR and the Data Protection Act 2018. The law also says information about your rights should be clear and easy to understand, which is reflected in Article 12 UK GDPR, Recital 39 UK GDPR and Recital 58 UK GDPR.

In plain English, a SAR is how you ask: “What personal data do you hold about me, and what are you doing with it?”

Personal data is any information that relates to you and identifies you, either directly or indirectly.

That can include obvious things such as:

• your name, address, email address or phone number;
• date of birth and account or customer reference numbers;
• photos, CCTV images or audio recordings of you; and
• copies of forms, applications or complaints you submitted.

But personal data can also include less obvious material, such as:

• internal emails discussing you;
• case notes or account notes about your behaviour or history;
• call recordings and chat transcripts;
• fraud markers, warning flags or internal risk scores;
• location data or login history linked to your account; and
• profiling or automated decision-making information about you.

It is important to understand that a SAR is about your personal data. It is not automatically a right to every document an organisation holds. Sometimes an entire document may be disclosed. In other cases, only the parts containing your personal data will be included.

The organisation is only expected to carry out a reasonable and proportionate search. That principle appears in Article 15(1A) UK GDPR. The organisation can therefore refuse requests it deems unreasonably burdensome or disproportionate, and it can ask you to clarify the scope of your request if it is too broad.

A SAR is not just about receiving a bundle of documents. Under Article 15 UK GDPR, you can usually ask for:

• confirmation that your personal data is being processed;
• a copy of the personal data itself;
• the purposes of the processing;
• the categories of personal data involved;
• the recipients or categories of recipients;
• the retention period, or how the organisation decides how long to keep the data;
• information about your rights to rectification, erasure, restriction or objection;
• your right to complain to the ICO;
• where the data did not come from you, any available information about its source; and
• information about automated decision-making or profiling, where relevant.

If personal data is transferred outside the UK in certain circumstances, you may also be entitled to information about the safeguards used for that transfer under Article 15(2) UK GDPR.

This is why a SAR can be useful even if you already know an organisation has information about you. It can help you understand not only what data is held, but also why it is being processed and who it may have been shared with.

Many people have heard of SARs but are not sure what they can actually request. Common examples include:

• customer service notes and complaint files;
• emails mentioning your name or discussing your case;
• call recordings and voicemail records;
• live chat transcripts or support ticket history;
• account notes, internal comments and case logs;
• CCTV footage showing you;
• copies of letters, forms or applications you submitted;
• records of decisions made about you;
• marketing preferences and consent records; and
• profiling information or automated decision records.

If you know the type of data you want, saying so can be helpful. A focused request can reduce confusion and make it easier for the organisation to identify what you are asking for.

That said, people often ask for “all personal data held about me”. This is not automatically invalid. If the organisation holds a large amount of information about you, it may ask you to clarify the scope of your request. That is recognised by Recital 63 UK GDPR and reflected in Article 12A UK GDPR.

A Subject Access Request does not need special legal wording.

The ICO says a request is valid if it is clear that you are asking for your own personal data. You can make a SAR:

• by email;
• by letter;
• through an online form;
• verbally; or
• in some cases, through social media.

You do not need to cite legislation, but doing so can help make your request clearer. A simple example could be:

If you already know what you want, you can be more specific. For example, you might ask for call recordings, account notes, complaint records, CCTV footage or emails that mention you.

A SAR can also be made by someone acting on your behalf. The ICO says that a third party such as a relative, friend, solicitor or service provider can make the request if they are authorised to do so. The right to use a representative is also recognised in Article 80 UK GDPR.

That means you can make a SAR yourself, or you can ask a service such as GetMySAR to prepare and submit it for you.

In most cases, an organisation must respond without undue delay and within one month.

This appears in Article 12 UK GDPR and the ICO’s guidance on responding to a SAR.

The deadline can be extended by up to two further months if:

• the request is complex; or
• the organisation has received a number of requests from you.

If the organisation extends the deadline, it should tell you within the first month and explain why. The detailed timing rules are set out in Article 12A UK GDPR.

Usually, yes. In most cases, an organisation cannot charge you for making a SAR.

The general rule is set out in Article 12(5) UK GDPR. The ICO also makes clear that controllers can no longer charge a general fee just because someone has exercised their right of access.

There are limited exceptions. An organisation may charge a reasonable fee if:

• the request is manifestly unfounded;
• the request is manifestly excessive; or
• you ask for further copies of the same information.

The DPA 2018 also allows for regulations to set limits on such fees in some circumstances through section 12 of the Data Protection Act 2018.

So the legal right itself is usually free to exercise directly. However, some people still choose to pay for help with the process.

GetMySAR charges a £20 service fee. That fee is not charged by the data controller and it is not a fee for the legal right itself. It is a fee for the service of preparing, submitting and managing the SAR on your behalf, including follow-up where needed.

Although the right of access is broad, it is not unlimited. An organisation may refuse or limit a SAR in some situations.

If an organisation refuses to comply, it should tell you why and explain that you can complain to the ICO and seek a judicial remedy. That duty appears in Article 12(4) UK GDPR.

Some SARs involve more sensitive situations, especially where the data relates to children, health records, education records or social work records.

These special rules are one reason SARs can become complicated in practice. A request that sounds simple at first can involve questions about safeguarding, third-party confidentiality, serious harm tests or parental authority.

If an organisation ignores your SAR, misses the deadline, gives an incomplete response or refuses without a proper reason, you may have options.

You may be able to:

• complain to the ICO;
• ask the ICO to investigate; and
• apply to the court for a remedy in appropriate cases.

The right to complain to the ICO appears in Article 77 UK GDPR. The right to an effective judicial remedy appears in Article 79 UK GDPR.

The ICO also has powers to require a controller or processor to comply with a data subject’s request under Article 58 UK GDPR.

In more serious cases, breaches of data subject rights can expose an organisation to significant enforcement action and fines under Article 83 UK GDPR.

The law also makes it an offence to alter, erase, destroy or conceal information with the intention of preventing disclosure in response to a valid access request. That appears in section 173 of the Data Protection Act 2018.

UK law also protects people from being pressured into using a SAR against themselves.

An enforced SAR is where someone requires you to make a subject access request so they can see records about you, such as health records, cautions or convictions, for example in connection with a job application, insurance or services.

The ICO states that forcing someone to do this in certain circumstances can be a criminal offence. The main statutory rules are found in section 184 of the Data Protection Act 2018 and section 185 of the Data Protection Act 2018.

In short, your right of access is meant to protect you. It should not be misused as a way for others to bypass proper legal disclosure routes.

You can usually make a Subject Access Request yourself for free. Many people do.

But in practice, SARs are not always as simple as sending one short email and waiting for a reply. Organisations may ask for ID, seek clarification, redact material, rely on exemptions or miss the deadline.

That is why some people choose to use GetMySAR.

• We help present the request clearly and in the right format.
• We can submit the request on your behalf with authority documents.
• We help reduce confusion about what to ask for and how to word it.
• We follow up with the data controller if a response is delayed.
• We make the process easier for people who do not want to deal with the legal and administrative side themselves.

Using GetMySAR does not create extra legal rights, and a data controller should apply the law fairly whether you act alone or through a representative. But many people prefer the convenience of having the request prepared, submitted and managed for them.

For those users, the £20 fee is a service fee for convenience and support, not a charge for the legal right itself.