Request Personal Data

There isn’t a particular format to sending an SAR to an organisation. You may wish to email, write, phone, DM or tweet the organisation and ask them to provide all the information they may hold about you, who they share it with and request copies of it.

The organisation should offer a few methods for you to send a subject access request but many may just have one way to do this, for example a web form (by the way it’s not best practice for an organisation to offer just one way for customers to send a SAR). All details of sending a SAR need to be clearly shown in their privacy policy and the link to their policy will generally be located toward the bottom of their website.

If an organisation tries their luck and wants to charge you a fee, inform them that, as of 25 May 2018, subject access requests can be made for free when GDPR became law in the UK as the Data Protection Act 2018.

To make a subject access request (SAR), you may wish to follow these steps:

  • Find out the right department and person to send the request to, normally they have a dpo@ email address on their website, or they might have a general contact or support email address
  • Note down all the information you need, so you can ask for this in the same request
  • Write to the organisation, including your full name, address and contact telephone number ; any information used by the organisation to identify or distinguish you from others of the same name (account numbers, unique IDs, etc); and include details of the specific information you require and any relevant dates
  • Include a reference to the one month deadline that applies when dealing with requests to provide personal information
  • Reference that you have the right to make a subject access request for free under the Data Protection Act 2018
Loading cart ...