Under UK data protection law, almost any organisation that holds information about you — an employer, a bank, a former landlord, a local authority, a debt collector — can be legally required to show you what it holds and how it is being used. This is called a subject access request, and it is a free, formal legal right, not a favour an organisation is choosing to grant you.
What a subject access request actually gets you
A subject access request, or SAR, entitles an individual to obtain a copy of their personal data held by an organisation, along with supplementary information about how that data is being used. This includes confirmation of what data is held, where it was obtained from, who it has been shared with, why it is being processed, and how long it will be kept. Requests can be made verbally or in writing, including by email or even through social media, and there is no requirement to use a special form or mention specific legislation for a request to count.
The one-month response deadline
An organisation must respond to a subject access request without undue delay, and in any case within one calendar month of receiving it. If a request is complex, or someone has made multiple requests, the organisation can extend this by a further two months — but it must tell the requester within the first month that it is doing so, and explain why. An organisation cannot simply stay silent and quietly take longer; the extension has to be actively communicated and justified.
If clarification is genuinely needed to identify what information is being asked for — for example, because the organisation holds a very large volume of data about the person — the one-month clock pauses until the requester responds, then resumes.
It should normally be free
In most cases, an organisation cannot charge a fee to comply with a subject access request. A reasonable fee can only be charged in specific circumstances: where a request is manifestly unfounded or excessive, or where someone asks for further copies of information they have already been given. An organisation relying on this exception needs to be able to justify it — it is not a general discretion to charge whenever convenient.
What can lawfully be withheld
The right of access is not unlimited. An organisation can refuse to disclose certain information where a specific legal exemption applies — for example, information that would identify another individual without their consent, certain material connected to crime prevention or detection, some legal professional privilege material, and some categories of health or child protection information. Where an exemption is used to withhold something, the requester is entitled to be told that information has been withheld, even if not shown the underlying content itself.
It is a criminal offence to force someone to make a SAR
One protection that surprises many people: it is a criminal offence for someone to require another person to make a subject access request and hand over the results, as a condition of employment, a job application, or a contract such as insurance. This is specifically aimed at stopping organisations from using SARs as a backdoor way to extract information — such as a full data history — that they would not otherwise be entitled to demand directly.
What to do if a request is ignored or refused
- Put the request in writing if it wasn’t already, and keep a clear record of when it was made and to whom.
- If the deadline passes with no response, or you believe an exemption has been wrongly applied, you can complain directly to the organisation first.
- If that doesn’t resolve things, you can complain to the Information Commissioner’s Office, the UK’s data protection regulator, which can investigate and take enforcement action against organisations that fail to comply.
- In some cases it is also possible to apply to court for an order requiring compliance, though this is a more significant step usually considered after other routes have been tried.
FAQs
Do I have to explain why I want my data?
No. A subject access request does not need to give a reason, and an organisation cannot lawfully refuse to comply simply because it doesn’t like or understand the requester’s motive for asking.
Can my employer use a SAR I’ve made against me later?
The request itself is your legal right and cannot be held against you for making it. However, be aware that the data an employer discloses in response could include material you didn’t expect, such as manager notes, so it is worth thinking through what you are asking for.
Does a subject access request cover information held about me by any organisation?
It applies to organisations that are processing your personal data as a data controller, which covers most employers, service providers, and public bodies. Some very specific exemptions and lighter-touch rules can apply to particular sectors, so it’s worth checking sector-specific ICO guidance if a request is refused entirely.