A UK subject access request (SAR) letter asks an organisation to provide a copy of the personal data it holds about you. You can use the blank template below, adapt it to your circumstances and send it to the organisation that controls the data; you do not need special wording or a legal reason to make a request.
What a subject access request is
A SAR is a way to exercise your right of access under the UK General Data Protection Regulation and the Data Protection Act 2018. It lets you ask an organisation, known as a data controller, whether it processes personal data about you and, if it does, to provide a copy of that data and certain related information.
The related information can include why your data is being used, the types of personal data involved, who has received or may receive it, how long it is expected to be kept, and information about where it came from if it was not collected from you. Depending on the circumstances, it can also cover information about automated decision-making. The right is to your personal data and the accompanying information, not automatically to every document, email or record in which your name appears.
You generally do not have to explain why you want the information. A request can be made verbally or in writing, including by email, and it does not have to use the phrase “subject access request”. A written letter is often useful because it records what you asked for and when.
Subject access request letter template
Blank letter template
To: ________________________________
Organisation or department: ________________________________
Date: ________________________________
Subject: Subject access request
Dear Data Protection Officer or Privacy Team,
I am requesting access to the personal data your organisation holds about me under the right of access in data protection law.
My full name: ________________________________
Other names used, if relevant: ________________________________
Contact details: ________________________________
Relevant account, customer, employee or reference number, if known: ________________________________
Please search these records or systems, if relevant: ________________________________
Relevant date range, if applicable: ________________________________
Please provide a copy of my personal data and the supplementary information required for a subject access request. I would prefer to receive the response by: ________________________________
Please let me know if you reasonably need further information to identify me or locate the data. I have attached the following identification or supporting details, if requested: ________________________________
Yours faithfully,
Signature, if sending a paper letter: ________________________________
Sample — fictional example
To: Privacy Team
Organisation or department: Northbridge Housing Association
Date: 14 May 2026
Subject: Subject access request
Dear Privacy Team,
I am requesting access to the personal data your organisation holds about me under the right of access in data protection law. Please search correspondence and repair records relating to my tenancy from January to December 2025. My name is Alex Example and my fictional tenant reference is NB-10482. Please send the response electronically to the email address you already hold for my account. Please let me know if you need further information to identify me.
Yours faithfully,
Alex Example
Who to send it to and what to include
Send the request to the organisation that decides how and why the relevant personal data is processed. Many organisations publish contact details for a data protection officer, privacy team or subject access team. If you cannot find a dedicated address, send it to the organisation’s general contact point and clearly mark it as a subject access request, asking for it to be passed to the appropriate team. You do not have to address it to a named data protection officer.
Make the request clear enough for the organisation to identify you and understand what information you are seeking. A broad request for all personal data may be valid, but specific clues can make a search more efficient. For example, an employee could identify a former department and approximate dates; a customer could provide an account number; and someone asking about a particular complaint could give its reference or date.
Include only information that is relevant and safe to share. An organisation may ask for evidence of identity if it has reasonable doubts about who is making the request. It should not routinely demand excessive documents when it can verify identity another way. If you send identity documents, use a secure method where possible and avoid including unnecessary sensitive details.
How to make the request manageable
Before sending your letter, decide whether you need a broad search or information connected with a particular issue. You can name likely departments, systems, topics, people you corresponded with, or a reasonable date range. These details are helpful, but you do not need to know the organisation’s internal systems or use technical terminology.
For instance, “all emails from the repairs team about the leak reported around March 2025” gives useful search clues. It does not guarantee that every matching email will be supplied: the organisation must identify your personal data and consider applicable restrictions, including other people’s rights. Avoid adding a long list of unrelated questions if your main purpose is to obtain your personal data; a SAR is not a general route to discovery of every record or an explanation of every organisational decision.
Keep a copy of the letter and note the date and method of delivery. If you submit it through an online form or by email, save the confirmation or sent message. This helps you follow up accurately if the organisation later says it did not receive the request.
What information can you receive?
A response may include copies or extracts from emails, letters, notes, account records, call logs, images or other material where those items contain your personal data. The format depends on the information and circumstances. If you made the request electronically, the information is generally provided in a commonly used electronic form unless you agree otherwise.
There is an important distinction between personal data and documents. You may be entitled to personal data contained in a document without being entitled to an unredacted copy of the entire document. An organisation might provide a redacted document, an extract, a schedule or another clear presentation of the information. The response should still make the personal data understandable; a pile of unexplained codes or disconnected fragments may not communicate it adequately.
Information about other people can affect what is disclosed. An organisation may need to remove or withhold details that identify someone else, unless it is reasonable to disclose them or another legal basis applies. This does not automatically mean that a whole record can be withheld just because another person is mentioned; the controller should consider whether the requester’s data can be separated or disclosed safely.
Response times, fees and format
In most cases, the organisation must respond without undue delay and within one month of receiving the request. If it needs additional information reasonably required to confirm your identity or clarify the request, the time limit may be affected while it waits for that information. Reply promptly if it asks a focused question, and keep a record of when you respond.
An organisation can extend the response period by up to two further months where a request is complex or it has received multiple requests from you. It must tell you about the extension and explain the reason within the initial one-month period. A request should not be delayed simply because the organisation has a busy workload.
A SAR is normally free. A controller may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, taking account of the circumstances; it may also charge for further copies in some cases. If it proposes a fee or refusal, it should explain its position and tell you about your right to complain to the Information Commissioner’s Office (ICO) and seek a judicial remedy. Do not assume that an organisation can charge simply because the response involves searching records.
Limits and common reasons for a partial response
The right of access is not absolute. Data protection law contains exemptions and restrictions, and the organisation must assess whether one applies to the information in question. For example, information covered by legal professional privilege may be withheld, and disclosure can be restricted where it would adversely affect another person’s rights. Other rules can apply in areas such as crime prevention, regulatory functions or confidential references. The exact outcome depends on the facts and the relevant legal provisions.
A partial response is not necessarily a failure. Some material may be redacted to protect another person’s information, or omitted under a relevant exemption. However, a vague statement that “an exemption applies” may leave you unable to understand what happened. You can ask the organisation to explain, in general terms, which information was withheld and why, while recognising that it may not be able to reveal details that would defeat the purpose of an exemption.
A SAR also does not require an organisation to create new information, answer general questions, or provide opinions that are not personal data it holds. If you want a correction, an explanation of a decision, or a copy of a specific contract, those may call for a separate request or process. You can make a SAR alongside another type of enquiry, but keep the requests distinct so each can be handled appropriately.
Common problems and what to do next
If you receive no acknowledgement, first check that the request reached the right organisation and that it has enough information to identify you. A short, polite follow-up can restate the date sent, the scope of the request and any reference number. If the organisation has asked for clarification, explain what you mean or narrow the search where you are willing to do so; do not provide unrelated personal details just to make the request seem more formal.
If the response appears incomplete, compare it with the scope of your original request. Point out a specific missing category, such as records from a named department or a date range, rather than simply saying that “everything” is missing. Ask the organisation to review its search and explain whether that category was searched, not held, or withheld. It may be useful to check whether you asked for personal data in the first place, rather than every document on a topic.
If the issue remains unresolved, use the organisation’s complaint process and consider raising the matter with the ICO. Keep copies of your request, the response, follow-up messages and relevant dates. The ICO can consider complaints about information rights, but it does not act as your personal representative or decide every dispute about the underlying events. If your circumstances require legal advice, ask a qualified professional.
Frequently Asked Questions
Can I make a subject access request by email?
Yes. A SAR can be made verbally or in writing, and email is a practical written method. State clearly that you are requesting your personal data, give enough information to identify yourself and keep a copy of what you sent.
Do I have to explain why I want my data?
No. You generally do not have to give a reason. You can provide a date range or topic to help the organisation find the information, but that is search guidance rather than an explanation of your motive.
Can I make a SAR for someone else?
You can submit a request on another person’s behalf when you have appropriate authority, such as valid permission or legal authority to act for them. The organisation may need evidence of that authority and must be satisfied it is protecting the other person’s information.
Can a SAR get me every document about a dispute?
Not automatically. It provides access to your personal data and required related information, not a guaranteed copy of every document or all information about an event. Some records may be outside the scope, partly redacted or subject to an exemption.
What if the organisation misses the deadline?
Check whether it asked for necessary identification or clarification, or properly notified you of an extension. If there is no adequate explanation, follow up in writing and use its complaint process; you can also consider complaining to the ICO.
Choosing the right request
Use a SAR when you want to see personal data an organisation holds about you, such as account notes, correspondence or records of how your information was used. If you only need a particular document, a direct request to the relevant department may be quicker. If you want to change inaccurate information, ask about rectification; if you want information deleted or processing restricted, those are separate data protection rights with their own conditions.
A concise request with useful search details is usually easier to process than a complicated letter filled with legal language. The template is a starting point: tailor the scope, provide proportionate identification if requested, and keep a clear record of the exchange.