How to Make a Subject Access Request (SAR)
You have the right to find out what an organisation knows about you. A subject access request is how you ask, and it is free in most cases.
By Siddharth ShankarUpdated October 18, 2026A subject access request (SAR), also called a DSAR, asks an organisation to confirm whether it uses your personal data and to send you a copy. In the UK, anyone can make one, in writing, by email, by phone or in person. Organisations usually have one month to respond. Be specific to get a faster answer, keep a record, and complain to the ICO if you get no reply.
Before you start opt-outs, see which known data breaches already include your email.
Free · About 30 seconds · No sign-up · Email not stored
Companies, councils, employers and public bodies can hold a surprising amount about you: account history, call recordings, notes, marketing profiles and data bought from others. A subject access request lets you see it. It is often the first step before asking for data to be corrected or deleted.
This guide follows the UK rules, using guidance from the Information Commissioner’s Office. People in the EU have a similar right of access under the GDPR.
What you can ask for
You can ask an organisation whether it is using or storing your personal information, and for copies of that information. You can ask for everything it holds, though organisations can sometimes refuse to give all or part of it, for example to protect other people’s data.
How to make a request
1Find the right contact
Check the organisation’s privacy notice for a data protection or privacy contact. Many have an online form.
2Write your request
Include a clear subject line, the date, your name and contact details, any account or reference numbers and the dates or topics you care about. Say what format you want the information in.
3Send it in a way you can prove
The ICO says requests can be made online, by email, by post, by phone or in person. Keep a record, especially for requests by post, phone or in person.
4Note the deadline
The ICO says organisations usually have one month to respond.
Removal is one half of the job. Check whether your email has leaked as well.
Free · About 30 seconds · No sign-up · Email not stored
A short template
I am making a subject access request under UK data protection law. Please confirm whether you process my personal data and send me a copy of it, along with where you got it and who you have shared it with. My details are: [name, address, email, account number]. I am particularly interested in [dates or topics]. Please send the information by email.
You do not need a solicitor. The ICO is clear that anyone can make a request.
Tips for a faster, better answer
- Be specific. The ICO notes that narrowing the request can speed up the reply.
- Expect an ID check. The organisation may ask you to prove who you are before releasing data.
- Ask where your data came from. This is how many people discover which data broker or partner shared their details.
If you get no reply or a poor reply
Remind the organisation of the deadline in writing. If it still does not respond properly, you can complain to the ICO. The ICO notes its guidance is under review because of the Data (Use and Access) Act, so check its page for any changes.
Useful organisations to ask
- Companies that send you marketing you never signed up for, to find out where they got your details.
- Your bank, phone company or insurer, to see call recordings and notes on your account.
- A former employer, for records held about you.
- Public bodies, such as the NHS, HMRC, DWP, DVLA, the Home Office or the police, which all accept requests for personal data.
Keep requests polite and specific, and send one to each organisation separately so the deadlines are clear.
What you might receive
Replies vary. Some organisations send a neat report. Others send folders of emails, call notes and database exports. Look for the source of your data, any third parties it was shared with, how long it will be kept and whether any of it is wrong. If you find mistakes, you can ask for them to be corrected.
What to do with what you find
Once you know what an organisation holds, you can ask it to correct mistakes, stop marketing or delete data. See how to ask a UK organisation to erase your data. In the EU, see the GDPR right to erasure. In California, the closest right is in the CCPA.
Sources
- ICO: Getting copies of your information (SAR) (what you can ask for, ways to ask, one month, what to include)
Frequently asked questions
Is a subject access request free?
In most cases, yes. Organisations normally cannot charge for a standard request.
How long does an organisation have to reply?
The ICO says organisations usually have one month to respond.
Can I make a SAR by email?
Yes. The ICO says you can make a request online, by email, by post, by phone or in person.
Is a DSAR different from a SAR?
No. DSAR stands for data subject access request. It is the same right.
Can I ask for my data on behalf of someone else?
Yes, with proof of permission such as written consent or a power of attorney.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.