This subject access request form is a letter you can copy and send to any organization that holds your personal data in the UK or the EU. The page also explains what to include, what official forms ask for, how long the organization has to reply, and when it can charge a fee or ask for ID.
The last section explains how an organization should respond to a request.
Subject access request template letter
Copy the text, replace the parts in square brackets, and delete the lines you do not need. The law does not require any set wording, so you can also write the request in your own words.
Subject: Subject access request
Date: [date]
To: [organization name]
[Data protection officer or privacy team, if named
in the privacy notice]
I am making a subject access request under Article 15
of the [UK GDPR / EU GDPR].
My details:
Full name: [name]
Other names you may hold: [former names, usernames]
Email: [email]
Address: [postal address]
Customer, account or employee number: [number]
Please send me:
1. Confirmation of whether you process my personal data.
2. A copy of my personal data.
3. The purposes of the processing, the categories of
data, the recipients, the retention period, the
source of the data if you did not collect it from
me, and whether you use automated decision-making
about me.
To help you find the data, it is most likely to be in:
[for example, emails between [date] and [date], call
recordings, CCTV at [place] on [date], my HR file]
I do not need: [for example, marketing emails you sent
me]
Please send the information by [email / post], in a
commonly used electronic format.
If you need more information to confirm my identity or
to find the data, please tell me as soon as possible.
[name]If you have moved, give both your current address and the address the organization has on file. The old address helps the organization match the request to its records.
If you write for someone else, such as a relative or a client, add a line saying you act for them and attach proof of your authority. The ICO names written permission from the person or a power of attorney as examples. Under the ICO's guidance on recognizing a request, the organization cannot comply until it has that evidence.
The right of access to a child's data belongs to the child. A parent can usually make the request for a child who is not mature enough to understand their rights. The ICO says that in Scotland a child aged 12 or over is presumed mature enough to make their own request. In the rest of the UK, the organization judges each child's understanding.
What to include in a DSAR form
The ICO's public guidance suggests these items:
- a heading such as "subject access request", and the date;
- your name, any other names the organization may hold, and your contact details;
- numbers that identify you, such as an account, customer, NHS or employee number;
- the information you want, with dates or details that help the organization find it;
- anything you do not need;
- how you want to receive the information, and any accessibility needs.
You can ask for everything the organization holds. The ICO says a specific request may be answered faster. You do not have to give a reason for the request.
You receive a copy of your personal data, not the original documents. Ireland's Data Protection Commission notes that the right does not cover other people's personal data or information that is not about you.
What official SAR forms ask for
The table compares four forms that organizations publish: the Disclosure and Barring Service (DBS) form, Spire Healthcare's online form, a school trust's form and the Joint Commission's web form. The law does not require a request to contain any of these fields.
| Field | Forms that ask for it | Why it is there |
|---|---|---|
| Name and contact details | All four | To identify you and send the reply |
| Date of birth | DBS, Spire, school trust | To identify you and find your records |
| Addresses for the last five years | DBS | To find certificates sent to earlier addresses |
| Requester type, such as patient, employee, parent or solicitor | Spire, school trust, Joint Commission | To choose which systems to search and to check authority |
| Reference numbers, such as a certificate number or hospital ID | DBS, Spire | To find records faster. Both forms mark them as optional. |
| Copies of two ID documents | DBS, Spire | To confirm identity. The identity checks section explains when an organization may ask for them. |
| Signed declaration | DBS, school trust | To confirm that you are the person, or that you act for them |
The DBS form also asks whether someone required you to make the request. Section 184 of the Data Protection Act 2018 makes this an offence in two cases. An employer may not require you to use a request to get your health records or records of convictions and cautions. A business may not make those records a condition of providing a service.
How to send the request
Send it to the contact named in the organization's privacy notice, usually a privacy email address or a data protection officer. If the organization has its own DSAR form or web portal, you can use it, but you do not have to.
- UK. The ICO says a person can make a request verbally or in writing, including through social media, and to any part of the organization. An organization may offer a form but should make clear that the form is optional. The ICO also runs a SAR service that writes an email request for you.
- EU. The EDPB's Guidelines 01/2022 on the right of access say there are no specific requirements on the format of a request. You can send it to any official contact point of the organization, even if the organization prefers another channel.
Keep a copy of the request and a record of when you sent it. For an online form, the ICO suggests a screenshot before you submit. For a phone call, write down the date and the name of the person you spoke to.
Response deadline and extensions
| Rule | UK GDPR | EU GDPR |
|---|---|---|
| Deadline | One month. The month starts on the last of these three events: the request arrives, the identity information the organization asked for arrives, or a permitted fee is paid (Art. 12A). | Without undue delay and within one month of receipt (Art. 12(3)) |
| Extension | Two further months if the request is complex or the person sent several requests. The organization must say so, with reasons, within the first month. | Two further months for complex or numerous requests. The organization must say so, with reasons, within the first month. |
| Pauses | If the organization reasonably needs more information from the requester to find the data, the clock stops until the requester answers (Art. 12A(5)). | Not in the GDPR text. The EDPB guidelines allow the clock to stop while the organization waits for identity information from the requester. The same applies when it holds a large amount of data and asks the requester which data they want. In both cases, the organization must ask without undue delay. |
The ICO's guidance on responding to a request counts the month from the day of receipt to the same date in the next month. If that date does not exist, the deadline is the last day of the month. A deadline on a weekend or bank holiday moves to the next working day. The ICO also says an organization may ask for clarification only where it is reasonably required, never as a standard step. The organization cannot force you to narrow the request.
Fees
A subject access request is free in most cases, under both the UK GDPR and the EU GDPR. An organization may charge a reasonable fee, based on its administrative costs, in two cases:
- the request is manifestly unfounded or excessive, for example because it repeats earlier requests (Art. 12(5));
- you ask for further copies of data you already received (Art. 15(3)).
For a manifestly unfounded or excessive request, the organization can refuse instead of charging, but it must be able to show that the request is manifestly unfounded or excessive. The ICO says a fee can cover the time to find, retrieve, copy and send the information, plus postage or storage media, and the organization should ask for the fee within one month of receiving the request.
Identity checks
An organization can ask for information to confirm who you are if it has reasonable doubts (Art. 12(6)). The checks must be proportionate to the risk. The risk is the harm that would follow if the organization sent your data to the wrong person.
- The ICO's own SAR service tells you to provide a copy of a passport or driving licence and proof of address, such as a bank statement or utility bill.
- The ICO's guidance for organizations says they should ask for formal ID documents only where necessary. Where your identity is obvious, for example because you are a current customer, further checks are unlikely to be needed.
- Under the UK GDPR, the one-month deadline starts when the organization receives the identity information it asked for.
- The EDPB says it is disproportionate to require a copy of an ID document from a person the organization has already authenticated, such as a logged-in account holder. Where a copy is needed, the EDPB says you may hide details the organization does not need, such as the photo or the ID number, unless national law requires a full copy.
To avoid delay, include identifiers the organization already holds, such as your account email or customer number, in the request.
UK changes under the Data (Use and Access) Act 2025
Three changes from the Data (Use and Access) Act 2025 affect UK requests, and all three are now in force:
- Time limits and "stop the clock". Section 76 added Article 12A to the UK GDPR, with the deadline, extension and clarification rules in the table above. It came into force on February 5, 2026, under the commencement regulations SI 2026/82.
- Reasonable and proportionate searches. Section 78 added Article 15(1A): you are entitled to the data an organization can find through a reasonable and proportionate search. The section took effect when the Act became law in June 2025, and it also applies to requests made since January 1, 2024. An organization does not have to search every place it could look, but it must search the places where it would expect to find your data.
- Complaints to the organization. Section 103 requires organizations to offer a way to complain about how they use your data, such as an electronic form. They must acknowledge a complaint within 30 days. This duty came into force on June 19, 2026.
The ICO's pages on subject access say they are under review because of the Act. The ICO may change their wording on deadlines, searches and complaints.
If you get no reply
The ICO's page on what to do if you get no response sets out three steps:
- If more than a month has passed with no reply, send a follow-up email or letter.
- If you are still not satisfied, complain to the organization, by email where possible, and keep copies of everything.
- Complain to the ICO within three months of your last meaningful contact with the organization.
In the EU, you can complain to the supervisory authority in the country where you live or work, or where the problem happened (GDPR Art. 77). Our directory of privacy regulators lists their contact pages.
For organizations: handling a subject access request
When a request arrives, log the date and channel, confirm the person's identity in proportion to the risk, search every system that may hold their data, and review the results before you send them. Remove other people's personal data and apply any exemptions. A subject access request response contains the data and the information listed in Article 15(1), such as the purposes, recipients and retention period.
If you publish your own DSAR form, ask for the details you need to find the data: name, contact details, account or reference numbers, the requester's relationship to the person, and the data wanted. Under ICO guidance, people can still make a request without the form.
The guide "Data subject access requests: how to respond, step by step" covers each step, with the deadlines under the GDPR, the UK GDPR and US state laws. The guide "DSAR automation: building the data subject request workflow" explains how to automate intake, deadline tracking and data lookups.
Frequently asked questions
Do I have to use the organization's subject access request form?
No. Neither the UK GDPR nor the EU GDPR sets a format for a request. An organization may offer its own form, but the ICO says the form must be optional, and the EDPB says you can write to any official contact point.
How long does an organization have to respond?
One month. It can extend this by two further months if the request is complex or you sent several requests, but it must tell you, with reasons, within the first month. In the UK, the month starts when the organization has your request and any identity information or permitted fee it asked for.
Can an organization charge a fee?
Usually not. A reasonable fee is allowed only when a request is manifestly unfounded or excessive, or when you ask for further copies of data you already received.
Do I have to send a copy of my ID?
Only if the organization has reasonable doubts about who you are, and the check must be proportionate. The EDPB says a logged-in account holder should not have to send an ID copy. Where a copy is needed, you may hide details the organization does not need, such as the photo.
Can I make a request for someone else?
Yes, if you can show you act for them. The ICO names written permission from the person or a power of attorney as proof. A parent can usually make a request for a child who is too young to understand their rights.
What can I do if the organization does not reply?
Send a follow-up, then complain to the organization. In the UK, you can then complain to the ICO within three months of your last meaningful contact with the organization. In the EU, you can complain to the supervisory authority in the country where you live or work, or where the problem happened.
Need this built?
We build request intake forms, identity checks, deadline tracking and data lookups as part of our Python and Node development work. Tell us about your project, and we will reply with questions or a rough plan.