How to make a subject access request

The right of access entitles you to confirmation that an organisation is processing your personal data, a copy of that personal data, and supplementary information about the processing. The supplementary information is the part people ignore and it is often the most useful: the purposes of the processing, the categories of data held, who it has been or will be disclosed to, how long it will be kept, where it came from if it was not obtained from you, your rights, and whether any automated decision-making or profiling is involved.

Personal data is information from which you can be identified, directly or indirectly. It is broader than a name on a document: it includes opinions about you, an identifier that maps to you, CCTV in which you appear, a voice recording of your call, an IP address linked to you, and free-text notes that describe you without naming you.

You are not entitled to whole documents. If an email refers to you in one sentence, your personal data is that sentence and its context, not the entire chain. Well-run organisations often provide the document anyway because extracting the data is harder than redacting the document, but you cannot demand a file simply because it concerns a matter you were involved in.

Other people's personal data is the main limit. An organisation does not have to disclose information about another individual unless that person consents or it is reasonable to disclose without consent. In practice this produces heavily redacted responses, and some redaction is legitimate. What is not legitimate is redacting the substance of an opinion about you because the author's name would be revealed — the author's identity can be removed while the content about you is disclosed.

There are specific exemptions. Legally privileged material, information used for management forecasting or negotiations where disclosure would prejudice them, some crime prevention and taxation material, references given in confidence in some circumstances, and certain regulatory functions can all be withheld. Exam scripts themselves are exempt, though marks and examiners' comments are not.

Health and social care records have their own overlay. Information can be withheld where disclosure would be likely to cause serious harm to the physical or mental health of the person or another individual, and where a record contains information about a third party. Requests are usually handled by the organisation's health records team.

A refusal must be explained. An organisation cannot simply decline: it must tell you why, tell you about your right to complain to the ICO, and tell you about your right to a judicial remedy.

Send it in writing even though you do not have to. A verbal request is legally valid, but a written one starts a clock you can prove. Email is fine, and sending it to a data protection officer, a privacy address or a formal complaints address is better than sending it to an ordinary customer service inbox that may not recognise what it is.

Say explicitly that it is a subject access request under the UK GDPR and the Data Protection Act 2018. Organisations have processes triggered by that phrase, and a request that reads like an ordinary complaint is routinely mishandled and lost.

Identify yourself precisely: full name, any former names, address and previous addresses if relevant, date of birth, and the account, customer, employee, patient or reference numbers the organisation uses. Vagueness here is the most common reason a request is delayed.

Be specific about what you want, but frame it as a scope rather than a limit. Naming the systems you believe hold data — call recordings, CCTV, internal email, the HR case management system, the CRM, the underwriting notes, the collections file — is far more effective than a generic request, because it makes it harder for an organisation to search narrowly and claim it found nothing. Give a date range where you can.

Do not restrict yourself unnecessarily. If you ask only for 'my complaint file', that is what you will get. If you ask for all personal data and then say you are particularly interested in specified categories, you preserve the full right while directing the search.

Attach identity evidence proactively — a photograph of a passport or driving licence and a recent utility bill or bank statement. An organisation is entitled to verify who you are, and reforms have clarified how the response period runs while identity or clarification is being sought, so supplying it up front removes the most common source of delay.

Diarise the deadline and follow up in writing the day after it passes. Organisations respond to deadlines being noticed. A short email noting that the statutory period has expired and that you will complain to the ICO if a response is not provided within a specified number of days is generally effective.

Keep every piece of correspondence. If it ends up at the ICO, the complaint is assessed on the paper trail: when you asked, what you asked for, what they said, and when.

The response is due within one month. Where a request is complex, or where a person has made a number of requests, the organisation can extend by up to two further months, but it must tell you within the first month that it is doing so and explain why. An extension announced on the last day of the third month is not a valid extension.

The clock interacts with identity verification and clarification. Where an organisation reasonably needs to confirm who you are, or genuinely needs clarification about what you want, that affects when the period runs — which is exactly why supplying identity documents and a clear scope with the original request is worth the effort. It removes the organisation's most defensible reason for delay.

An organisation can refuse or charge a reasonable fee only where a request is manifestly unfounded or manifestly excessive. Those are high thresholds and are not met simply because a request is large, inconvenient, made during a dispute, or made by someone the organisation finds difficult. A request made with the intention of causing disruption rather than exercising the right, or repeated requests for the same data, are the sorts of cases the exception is aimed at.

Making a request during a grievance, a tribunal claim or a complaint is entirely legitimate. Organisations sometimes suggest it is an abuse of process. It is not, and the ICO has been clear that motive is generally irrelevant to whether the right applies.

If a response arrives and is obviously incomplete — no call recordings from a period you know you telephoned, no emails at all from a manager you know discussed you — say so specifically and ask what systems were searched. A concrete challenge is much more effective than a general complaint that the response was inadequate.

Redaction should be explained. You are entitled to know, in general terms, why material has been withheld and under which exemption. Blanket black boxes with no explanation are a legitimate ground of complaint.

Complain to the organisation first, in writing, and use the words 'formal complaint'. Address it to the data protection officer if there is one; large organisations and all public authorities must appoint one. Set out the date of the request, what you asked for, what you received, and what you say is missing or wrongly withheld.

Then complain to the Information Commissioner's Office. It is free, it covers the whole UK, and it can be done online. The ICO will normally expect you to have raised it with the organisation first and to have given it a reasonable time — usually a further period after the complaint — to put things right.

Be clear about what the ICO does and does not do. It regulates: it can assess whether the organisation complied, tell it to take action, and in serious cases take enforcement action or issue fines. It does not award you compensation and it does not act as your advocate in an underlying dispute.

Compensation is a court matter. The Data Protection Act 2018 provides a right to claim compensation for damage, including distress, caused by a breach of the legislation. Claims of this kind are brought in the county court, often on the small claims track, and the evidence of loss or distress matters more than the fact of the breach.

You can also apply to the court for an order requiring compliance where an organisation simply refuses to respond. In practice, the prospect of an ICO complaint resolves the great majority of cases without any of this.

For credit reference agencies there is a separate statutory route to a copy of your credit file, and all three main agencies provide free access. Where the dispute is about the accuracy of credit data rather than access to it, the correction route through the agency and the lender is usually faster than a subject access request.

If the organisation has gone out of business, the data controller obligations may have passed to an administrator, a purchaser of the business or a successor body. Find out who holds the data now and direct the request there rather than assuming the right has evaporated.

Employment disputes. An HR file, investigation notes, emails between managers, and notes of meetings are usually the decisive evidence in a grievance, disciplinary or tribunal claim, and much of it is personal data. Making a request early — before positions harden — is materially more productive than making one after proceedings have started.

Insurance and financial services. Underwriting notes, claim assessment records, call recordings and the reason codes attached to a declined application are all held, and a declined claim or a refused product often looks different once the internal notes are visible.

Housing. Landlord and letting agent records, repair logs, contractor visit notes and internal correspondence are frequently the difference between a disrepair claim that succeeds and one that fails on evidence of notice.

Debt and enforcement. A request to a creditor or debt purchaser produces the account history and the notes of what was said and agreed, which is often where an unfair or wrongly calculated balance becomes visible.

Health and social care. Access to your own medical or care records is the route to understanding a decision, supporting a complaint, or preparing a claim. Requests go to the GP practice, hospital trust or health board rather than to a central body, and the serious harm exemption applies.

Complaints about public authorities. Where you want your own data, use a subject access request. Where you want information that is not about you — policies, statistics, decision-making criteria, correspondence about a general issue — the right tool is a freedom of information request instead, and the two are frequently confused. A single letter asking for both is common and perfectly acceptable, but say which parts are which.

Data protection is a reserved matter, so the UK GDPR and the Data Protection Act 2018 apply identically in England, Scotland, Wales and Northern Ireland, and the Information Commissioner's Office regulates all four. A subject access request works the same way wherever you live and wherever the organisation is based, provided it is subject to UK data protection law. Reforms under the Data (Use and Access) Act 2025 apply UK-wide too.

Freedom of information is not reserved, and this is the point most often missed. Requests to UK-wide public authorities and to authorities in England, Wales and Northern Ireland are made under the Freedom of Information Act 2000 and are regulated by the ICO. Requests to Scottish public authorities — the Scottish Government, Scottish local authorities, NHS boards in Scotland, Scottish universities and Police Scotland — are made under the separate Freedom of Information (Scotland) Act 2002 and are regulated by the Scottish Information Commissioner, not the ICO.

That means a complaint about a Scottish council refusing information goes to the Scottish Information Commissioner, while a complaint about the same council mishandling your personal data goes to the ICO. Sending either to the wrong regulator costs months.

Health records access differs practically rather than legally. In England requests generally go to the GP practice or NHS trust, with online access to parts of the record through the NHS App. Scotland, Wales and Northern Ireland run their own health service structures and their own record systems, so the route into the record — and the online access available — is different in each, even though the underlying right is the same.

Social care and education records also sit within devolved systems. A request about a child's education record or a social work file is made to a body operating under devolved law, and the accompanying subject-specific access regulations differ between the nations, so use the devolved guidance alongside the ICO's.

The practical rule: for anything about you, the ICO and the same UK-wide right apply everywhere. For anything that is not about you, check whether the authority is Scottish before deciding which Act and which regulator you are using.