What is a subject access request?

How it works

1. People are typically entitled to confirmation of whether their information is being processed, and to a copy of that information. Other details can include the purposes and the categories of information. They can also include who it is shared with, and how long it will be kept, or the criteria for deciding. There are exemptions. ²
2. You can make a request directly to the organisation. The ICO's guidance on recognising a SAR says there are no formal requirements for a valid request. A person can make one verbally or in writing, including by social media. They do not have to use the phrases subject access request, right of access, or article 15 of the UK GDPR. ³
3. The ICO also provides a public service that helps someone email a request to an organisation they name, and keeps a copy for their records. The ICO will not see the organisation's reply. ¹

What UK guidance says

The ICO public page says you will need the organisation's name and a suitable email address, often in its privacy notice. You should also provide proof of ID and address. Requests on someone else's behalf need evidence that you are allowed to do that. Controllers are responsible for responding. If they use a processor, they still have to deal with the request. ¹²

The ICO organisation guidance was last updated on 8 December 2025 and is not marked under review. It says a controller must comply without undue delay and at the latest within one month of receipt of the request. The time limit can pause while identity or clarification is obtained, and then resume. The ICO public SAR page is under review because of the Data (Use and Access) Act, so later changes are possible. ⁴¹

Warning signs

• An organisation will not say whether it holds your personal information, or how it is being used. ²⁵
• Someone offers to make a request for you without evidence that they are allowed to act on your behalf. ¹
• A page or message quotes a deadline that does not match the ICO's one-month rule. It may also ignore that the clock can pause for identity or clarification. ⁴

How to protect yourself

• A request does not have to use a special form or the words subject access request. ²
• Keep a copy of what you send. If you use the ICO helper, it keeps a copy for your records, and the ICO will not see the organisation's reply. ¹
• This is general information, not legal advice. Secordit cannot make the request for you or speed up a reply. ¹⁵

Frequently asked questions

How do I ask an organisation for the personal information it holds about me?

You can write to the organisation directly, or use the ICO helper to email a request. You will need the organisation's name and a suitable email address, often in its privacy notice, plus proof of ID and address. ¹²

How long does an organisation have to respond?

The ICO organisation guidance says a controller must comply without undue delay and at the latest within one month of receipt. The clock can pause while identity or clarification is obtained. The public SAR page is under review because of the Data (Use and Access) Act, so later changes are possible. This is not legal advice. ⁴¹

Does my request have to use a special form?

No. The ICO's guidance on recognising a SAR says there are no formal requirements for a valid request. A person can make one verbally or in writing, including by social media, and does not have to use those phrases. Controllers are still responsible for responding, even if they use a processor. ³²