There isn’t a particular format to sending an SAR to an organisation. You may wish to email, write, phone, DM or tweet the organisation and ask them to provide all the information they may hold about you, who they share it with and request copies of it.
If an organisation tries their luck and wants to charge you a fee, inform them that, as of 25 May 2018, subject access requests can be made for free when GDPR became law in the UK as the Data Protection Act 2018.
To make a subject access request (SAR), you may wish to follow these steps:
- Find out the right department and person to send the request to, normally they have a dpo@ email address on their website, or they might have a general contact or support email address
- Note down all the information you need, so you can ask for this in the same request
- Write to the organisation, including your full name, address and contact telephone number ; any information used by the organisation to identify or distinguish you from others of the same name (account numbers, unique IDs, etc); and include details of the specific information you require and any relevant dates
- Include a reference to the one month deadline that applies when dealing with requests to provide personal information
- Reference that you have the right to make a subject access request for free under the Data Protection Act 2018