You have the right to ask an organisation if they're using or storing your personal information. You can also ask them for copies of your personal information.
This is called the right of access and is also known as making a subject access request, a SAR or a DSAR.
Anyone can make a SAR. You don’t need a solicitor or a lawyer.
Organisations usually have one month to respond to a SAR.
What should I include in a SAR?
We suggest you include the following information in a SAR:
- a subject line or header that says "subject access request";
- the date you’re making the request;
- your name (and any other names where relevant, eg your name before you were married);
- your email address, home address and phone number;
- customer account numbers, NHS number, employee number, product number or similar information that can help identify you;
- what personal information you want (be specific about the information you’re asking for, and where relevant say what information you don’t need);
- details or dates that will help the organisation find the information you want;
- the reason you want the information (you don't have to include this but it will help the organisation find what you need); and
- how you would like to receive the information (eg electronically or printed and sent by post) and if you have any accessibility requirements (eg large fonts).
Can I ask for all the information the organisation holds about me?
Yes. You can ask for all the information an organisation holds about you. However, this doesn’t mean you will get all the information they have about you. An organisation can sometimes refuse to provide you with all or some of the information.
It might also mean you get a lot of information back that you don't need. Sometimes, the organisation is allowed to take longer to send it as well.
When asking for information, be as specific as possible. This may help you to get the fastest possible reply and more useful information back.
How do I send my subject access request?
The easiest ways to make a SAR include:
- Online - many organisations let you submit SARs through their website. If you do this, you should take a screenshot of your request for your records before you press submit.
- Email - use our SAR service to create and send an email request to an organisation or contact the organisation directly.
You can also make requests by post, over the phone or face to face. If you do this, make sure to keep records of when you made your request and who you spoke to, where relevant.
Tip: You can usually find suitable contact information for people who deal with SARs on an organisation’s privacy notice or on their website.
Can I make a SAR for someone else?
Yes. You can make a SAR for someone else if you can prove you have the person's permission to get the information for them.
When you submit a request for someone else, the organisation will ask for proof such as:
- written permission from the person; or
- a power of attorney document.
They don't have to give you the information you ask for if they are not happy you have permission to receive it.
If you are letting someone make a SAR for you, think – are you happy for that person to get some or all of your personal information?
They could gain access to information that you don’t want to share with them, such as your medical history.
