You have a legal right to ask almost any organisation that holds data about you to show you exactly what it has. That includes your bank, your employer, your landlord, a charity, your council, or an app you signed up to years ago and forgot about. It is called a subject access request, it is free, and most people have never used it. This guide explains how to make one, what you are entitled to receive, and what to do when a company stalls.

What a Subject Access Request Actually Is

A subject access request, often shortened to SAR or DSAR (data subject access request), is a formal request under data protection law. When you make one, you are not asking a company for a favour. You are triggering a legal obligation. The company must respond, and if it does not, you can take it further.

This is different from the “download your data” buttons many apps offer. Those tools are voluntary, and companies design them to show what they choose to show. A subject access request covers everything the organisation holds about you, including notes, call records, internal emails that mention you, and data bought from third parties.

The right applies wherever the company is based, as long as it handles the personal data of people in the UK or EU. A US advertising platform that targets UK users is covered. So is a data broker outside Europe that holds profiles of EU residents.

Where the Right Comes From

In the UK, the right comes from Article 15 of the UK GDPR, alongside the Data Protection Act 2018. In the EU, it is Article 15 of the EU GDPR. The two are almost identical.

The law makes no distinction by size or type of organisation. A sole trader, a multinational, a local council and a housing association all have the same duty.

If you live in the US

There is no single national right, but California’s privacy law gives residents a “right to know” what personal information a business has collected about them, and several other states, including Virginia, Colorado, Connecticut and Texas, now give residents similar access rights. Businesses covered by California’s law generally have 45 days to respond, which they can extend once. Many large companies honour access requests from all users, so it is worth asking wherever you live.

How to Make a Subject Access Request

You do not need a lawyer, a special form, or any particular wording. In the UK, a request can even be made verbally. A written request is still the best choice, because it gives you a record of exactly what you asked for and when.

1. Find the right contact

Check the organisation’s privacy policy for a Data Protection Officer or a privacy email address. Public bodies, and companies whose business involves large-scale monitoring of people or sensitive data, must have a Data Protection Officer. If there is none, send your request to the privacy or legal team rather than general customer service, where requests can get lost. Some companies also have an online request form.

2. Use a clear request

You can copy this template and fill in the brackets:

Subject: Subject access request

Dear [organisation name], I am making a subject access request under Article 15 of the [UK GDPR / EU GDPR]. Please send me a copy of all personal data you hold about me, together with: the purposes for which you process it and your legal basis; who you have shared it with; how long you will keep it; where you got it from, if not from me; and any automated decision-making or profiling that affects me. To help you find my data, my details are: [full name, address, email, phone number, account or customer number]. [Optional: I am particularly interested in data from (date) to (date) / relating to (topic).] Please reply within one month. Thank you, [your name], [date].

3. Keep proof you sent it

Send it by email and keep a copy, or by tracked post. If you later need to complain to a regulator, you will need to show when the organisation received your request.

4. Expect an identity check

The organisation can ask you to prove who you are if it has a genuine doubt, but only with reasonable checks. The one-month deadline starts once it has what it needs to confirm your identity.

Your first copy of your data is free. An organisation can charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive, or if you ask for further copies.

Companies hold detailed records about you, and the law has to force them to show you. That imbalance is at the heart of Wes Kussmaul’s Escape the Plantation, and you can get a free copy at the end of this article.

What Companies Must Give You

The response must include the personal data itself, not a summary or a statement that data exists. It must also tell you:

• Why they are using your data, and the legal basis they rely on, such as a contract, consent or “legitimate interests”.
• Who they have shared it with or will share it with, including processors, advertising networks and data brokers.
• How long they plan to keep it.
• Where they got it from, if they did not collect it from you.
• Whether they use automated decision-making or profiling that affects you, with meaningful information about the logic involved.
• Your other rights, including to have data corrected or deleted, and to complain to the regulator.

The point about automated decisions is often left out. If an algorithm affects your credit, insurance price or job application, you have a right to know about it. Ask for it if it is missing.

Organisations can remove information that would identify other people, but they cannot use that as an excuse to withhold whole sections of your own data.

When Companies Stall, Refuse or Respond Badly

The deadline is one calendar month. It can be extended by up to two further months for complex or numerous requests, but only if the organisation tells you within the first month and explains why. Silence is not an extension. Under recent UK changes, an organisation can also pause the clock while it asks you to clarify a very broad request, and it only has to carry out reasonable and proportionate searches.

Watch for common delaying tactics:

• Excessive identity demands, such as asking for documents it does not need.
• Claiming the request is too complex, without formally extending the deadline.
• Sending only a self-service download link instead of a full response.
• Not replying at all.

If the deadline passes or the response is incomplete, first write to the organisation, quoting your original request and the date. Our guide on how to complain so companies have to respond helps with the wording. If that fails, complain to the regulator: the Information Commissioner’s Office in the UK, or your national data protection authority in the EU. Regulators do act on these complaints, although investigations can take months.

Keep copies of everything: your request, any acknowledgement, and any reply. If misuse of your data has caused you financial loss or distress, a claim for compensation through the courts is also possible.

What the Data You Receive Tells You

When the response arrives, treat it as an audit:

• Compare purposes with reality. A company that says it holds your data “to fulfil your contract” but has shared it with fourteen advertising partners deserves questions.
• Read the sharing list. Most people are surprised by how many organisations have received their information.
• Check retention. If the privacy policy says data is kept for two years but you receive records from five years ago, raise it.
• Fix mistakes. You have a separate right to have inaccurate data corrected, and in many cases a right to have data deleted if there is no good reason to keep it.

If the response reveals that your data was lost or exposed, see Was Your Data in a Breach? How to Check and What to Do.

The Limits of the Right, and Why They Matter

Exemptions exist for crime prevention, national security and legal privilege, among others. They are legitimate in principle but are sometimes stretched further than the law intends.

Even a technically compliant response can hide more than it reveals. Data supplied in an unusable format, or buried in thousands of pages of logs, meets the letter of the law but not its purpose.

The deeper problem is that this right is individual and reactive. It only helps people who know it exists and use it. Regulators can audit companies proactively, but they rarely have the resources to do so at scale. A system that relies on individuals to trigger oversight will always leave wider failures unchallenged, a pattern we explore in Platform Accountability: Why the Gap Never Closes.

Frequently asked questions

How do I make a subject access request?

Email or write to the organisation’s Data Protection Officer or privacy team asking for a copy of all the personal data it holds about you, plus details of how it uses and shares it. Include enough information for them to find your records, keep proof that you sent it, and expect a reply within one month.

Is there a subject access request template?

Yes. You can use the template in this article. You do not have to use any particular wording, but a clear request listing everything you are entitled to makes it harder for an organisation to send an incomplete reply.

How long does a company have to respond to a subject access request?

One calendar month from receiving it, or from receiving any ID it reasonably asked for. It can extend this by up to two more months for complex requests, but only if it tells you within the first month and explains why.

Can a company refuse a subject access request?

Only in limited cases, such as when a request is manifestly unfounded or excessive, or when specific information is covered by an exemption. It must explain its reasons and tell you about your right to complain. A blanket refusal with no explanation is not allowed.

Does a subject access request cost anything?

No. Your first copy is free. An organisation can only charge a reasonable fee for further copies, or for requests that are manifestly unfounded or excessive.

Related reading

• Was Your Data in a Breach? How to Check and What to Do
• How to Complain So Companies Actually Have to Respond
• Platform Accountability: Why the Gap Never Closes
• Who Is Accountable When a Platform Fails? A Field Guide

You have a right to know what companies hold on you, but today you have to ask for it, one company at a time. Wes Kussmaul’s Escape the Plantation explains how identity you own and control would put you back in charge of your own information. Enter your email below to get your free copy and follow The Untouchables’ work on accountability online.