How to Make a Subject Access Request

Thinking about making a Subject Access Request, or handling one for your organisation?

In this guide, you’ll learn exactly how to make a Subject Access Request, what to include, and what happens once it’s submitted. You’ll also find clear, practical advice for organisations on how to respond properly and stay compliant with UK data protection law.

At Goodwille, we understand UK compliance inside out. Trusted by over 450 international companies, we’re here to share the practical guidance you need to get it right.

What is a Subject Access Request (SAR)?

A Subject Access Request (SAR) is a formal request made by an individual to find out what personal information an organisation holds about them, how it’s being used, and who it’s shared with. It’s one of the key data protection rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Under the UK GDPR, individuals have the right to:

• Be informed about how their data is being used
• Access their personal data
• Have incorrect or outdated information corrected
• Ask for their data to be deleted
• Limit or stop processing of their data in some situations
• Move or reuse their data between different services
• Object to how their data is being used in certain circumstances

What is Personal Data?

The UK GDPR defines personal data as:

“‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Let’s put that into simple terms. Personal data refers to any piece of information that can identify a living person, either directly or indirectly.

It’s what makes you you in the eyes of an organisation, whether that’s your name, email address, customer number, or even data that, when combined with other details, could identify you.

Information Identifying an Individual

This type of personal data includes any details that clearly identify a person on their own. Common examples are:

• Full name
• Home or business address
• Email address
• Telephone number
• Date of birth
• Identification numbers (such as a National Insurance number or employee ID)

For businesses, this is often the kind of information collected through everyday activities, like setting up customer accounts, processing orders, or managing employee records.

Information Relating to an Individual

Sometimes data doesn’t identify someone directly but still relates to them or their activities. This type of personal data helps form a picture of who someone is, even without their name attached. Examples include:

• Employment or HR files
• Purchase or transaction history
• Customer service notes or call recordings
• Medical or health information
• Performance reviews or disciplinary records
• Online browsing behaviour or preferences

How to Make a Subject Access Request

Making a Subject Access Request (SAR) is usually simple. Whether you’re an individual looking to access your data or a business responsible for handling these requests, the process follows the same key steps.

Step 1 – Writing the Request

You don’t need to fill out a special form or use any particular wording – your request can be made by letter, email, or even verbally. As long as it’s clear that you’re asking for access to your personal data, it counts as a valid SAR.

However, the ICO recommends including the following to help the organisation process your request quickly and accurately:

• A subject line or header that says “Subject Access Request”
• The date you’re making the request
• Your full name (and any previous names, such as a maiden name)
• Your email, home address, and phone number
• Any reference numbers that can help identify you (e.g. customer number, employee number, NHS number)
• A description of what information you want (and, if relevant, what you don’t need)
• Any relevant dates or details that might help locate the information
• How you’d like to receive the data (for example, electronically or by post) and any accessibility requirements (e.g. large print)
• (Optional) The reason you want the information, as this can help the organisation narrow it down

The clearer your request, the faster an organisation can find and share the right information.

Step 2 – Sending It to the Right Person

You can usually submit a Subject Access Request (SAR) through the organisation’s website or by contacting them directly via email. It’s best to check the organisation’s privacy notice first, as this will often include the correct contact details for such requests.

If you prefer, you can use the ICO’s SAR service, which helps you create and send your request to the right organisation quickly and securely.

You can also send your SAR by post, but make sure to use recorded delivery so you have proof that your request was received and the response timeline can be tracked accurately.

Step 3 – Verifying Identity

Before releasing any personal data, an organisation must make sure they have the sufficient information to confirm your identity to make sure nothing ends up in the wrong hands. To do this, they might ask for identification like your passport or driving licence.

Businesses should only ask for what’s necessary and handle all identification securely, following data protection principles.

Step 4 – Charging Fees

Most Subject Access Requests are free of charge. However, an organisation can charge a small administrative fee, or refuse to respond, if the request is “manifestly unfounded or excessive.” For example, if you’re requesting further copies of information you’ve already received.

Step 5 – Third-Party Requests

Sometimes, someone else – such as a solicitor, family member, or guardian – may make a SAR on your behalf. In these cases, the organisation must check that the person is authorised to act for you before sharing any information.

This might mean requesting written consent or legal documentation. It’s an important safeguard that protects your privacy and ensures data isn’t disclosed to the wrong person.

How Long Does a Company Have to Reply to a SAR?

Once a company receives a valid Subject Access Request, it has one calendar month to respond. This countdown begins the day the request is received, given that the company has all the information they need to respond.

There’s no extra time for bank holidays or shorter months. However, if the deadline falls on a weekend, the organisation can reply on the next working day.

In some cases, that month might not be enough. If the request is complex, or the company receives several requests from the same person, the deadline can be extended to three months.

Extensions are usually granted when:

• The business needs to confirm the requester’s identity
• More details are needed to locate the correct data
• The request itself needs clarification
• The request asks for sensitive information, like the medical records of another person

In these situations, the clock pauses while the business waits for the information, then restarts once it’s received.

Can a Company Refuse a Subject Access Request?

Yes, companies can refuse or limit a response if the request is manifestly unfounded, manifestly excessive, or if a legal exemption applies.

That said, refusals should never be made lightly. Every decision must be justified, documented, and communicated clearly to the individual, including how they can challenge it.

What Does “Manifestly Unfounded” Mean?

“Manifestly unfounded” means a request is being made with bad intentions. Most SARs aren’t unfounded, but some may cross the line.

According to the ICO, requests may be manifestly unfounded if:

• The person has no real intention of accessing their data. For example, they ask for it, then offer to withdraw the request in exchange for something.
• It’s designed to harass or disrupt the organisation rather than get information.
• The requester admits their aim is to cause inconvenience or damage.
• They make baseless accusations against the company or staff, clearly driven by malice.
• They target a specific employee due to a personal grudge.
• They repeatedly send requests in a campaign-style manner just to tie up resources.

What Does “Manifestly Excessive” Mean?

The term “manifestly excessive” refers to requests that are clearly unreasonable when weighed against the time, cost, and effort needed to respond. The focus isn’t on how big the request is, but whether it’s proportionate.

When assessing if a request is excessive, businesses should consider:

• The type and volume of information being asked for
• The relationship between the requester and the organisation
• Whether refusing could cause significant harm or disadvantage
• The company’s resources and capacity to handle requests
• If the request repeats previous ones made recently
• Whether it overlaps with other ongoing requests

What are Exemptions?

The UK GDPR and Data Protection Act 2018 recognise that sometimes it’s not appropriate, or even lawful, to release certain information. That’s where exemptions come in.

A business might apply an exemption if sharing the data would:

• Reveal someone else’s personal information
• Breach a duty of confidentiality
• Interfere with investigations or legal proceedings
• Jeopardise public safety or crime prevention efforts

That being said, exemptions like these should always be considered on a case-by-case basis.

How to Refuse a SAR as a Business

If you decide to refuse or limit your response to a SAR, you must write to the individual and explain:

• Why you’re not providing all (or any) of their data
• Their right to complain to the Information Commissioner’s Office (ICO)
• Their right to take legal action if they disagree with your decision

If you believe the request is manifestly unfounded or excessive, you’ll also need to provide evidence of why. Keep a record of your reasoning and any relevant communications – the ICO may ask to review them if the individual raises a complaint.

How to Handle Subject Access Requests Effectively as a Business

Managing Subject Access Requests (SARs) becomes much simpler when you have clear systems in place. With the right preparation, you can stay compliant, protect your reputation, and give customers confidence in how you handle their data.

Practical tips for success:

• Create a clear SAR policy – Define who’s responsible for responding to SARs, outline each step, and use a simple checklist to keep your process consistent.
• Train your team – Help employees recognise SARs (even when they’re not labelled as such) and know exactly what to do next.
• Keep data organised – Well-structured, secure data storage makes it easy to locate and review information quickly.
• Request further information if needed – This ensures you’re sending what’s needed on your first response, and you’re not sending more information than you need to.

Gain Confidence in Managing SARs with Goodwille

Struggling to keep track of data or worried about handling a Subject Access Request the right way? We’re here to help.

Here’s how we support you at Goodwille:

• UK GDPR made simple – You’ll know exactly where you stand, with clear processes and peace of mind that your obligations are covered.
• Smart, web-based tools built for clarity – Our integrated systems make managing data straightforward and secure.
• Expert guidance for complex SAR management – For businesses handling detailed or sensitive SARs, our team provides expert support backed by over 25 years of experience.

Speak to our corporate governance experts – and gain the confidence that your business can handle SARs the right way, every time.

Frequently Asked Questions

Here are some of the most common questions we get on subject access requests, and clear answers to each.

How Can a SAR Be Made?

A Subject Access Request (SAR) can be made in writing, by email, or even verbally. As long as your request clearly asks to see the personal information an organisation holds about you, it counts as valid.

You can send it directly to the company or use the ICO’s SAR service, which helps you draft and send your request to the right place.

What is an Example of a Subject Access Request?

Here’s a practical example of how you might write a Subject Access Request email:

Subject: Subject Access Request

Date: 12 February 2025

Dear (Company Name),

I’d like to request access to all personal data your organisation holds about me under the UK GDPR. I recently noticed some inaccuracies in my account details and would like to review the information you have to make sure it’s correct and up to date.

My details are as follows:

• Full name: Jane Smith (previously Jane Turner)
• Email: jane.smith@email.com
• Address: 1 Street Name, City, Postcode
• Phone: 07123 456 789
• Customer reference: #987654

Please provide:

• Copies of any personal data held in your records
• Details of how my data is being used and who it has been shared with
• Information about how long you intend to keep it

I’d prefer to receive this information electronically by email.

Thank you for your help,
Jane Smith

How Much is a Subject Access Request in the UK?

In most cases, making a SAR is completely free.

However, if the request is considered “manifestly unfounded or excessive” (for example, if it’s repetitive or made in bad faith), the organisation can charge a reasonable fee or refuse to respond.

Do I Need to Give a Reason for a SAR?

No, you don’t have to give a reason for making a Subject Access Request. It’s your legal right under data protection legislation to know what personal data an organisation holds about you.

That said, giving a brief explanation can help the organisation find the information requested faster and provide a more complete response.