Your right to see the personal data an organisation holds about you: how to ask, what you are entitled to, deadlines, exemptions and what to do if they don't reply.
This guide gives general information about the law in the UK, not legal advice about your situation.
Under UK data protection law, you have the right to find out what personal information an organisation holds about you, why it uses it and who it shares it with. This is called a subject access request (SAR). It is free in most cases and you do not have to give a reason. People use SARs in disputes with employers, to see what a company has recorded about a complaint, or simply to check what is held.
What you are entitled to?
- confirmation that the organisation is processing your personal data;
- a copy of that data;
- supporting information: the purposes, the categories of data, who it has been shared with, how long it will be kept, where it came from, and your other rights, such as correction and erasure.
You are entitled to your information, not necessarily whole documents. An organisation may redact other people's details.
How do you make a request: step by step?
- Find the right contact. Look in the organisation's privacy notice for a data protection officer or privacy email address. A request can be made to any part of the organisation, verbally or in writing, but writing gives you a record.
- Say clearly that it is a subject access request under the UK GDPR.
- Help them find your data: give your full name, any account or reference numbers, previous addresses, and, if relevant, the dates, departments or types of information you are interested in. Being specific can speed things up.
- Say how you want to receive it, such as electronically.
- Keep a copy and a note of the date you sent it.
The organisation can ask for proof of identity if it reasonably needs to. The time limit then usually runs from when you provide it.
Deadlines
The organisation must respond without undue delay and within one calendar month. It can extend this by up to two further months if the request is complex or you have made several requests, but it must tell you within the first month and explain why. Searches must be reasonable and proportionate.
Fees and refusals
A SAR is normally free. An organisation can charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive, for example repetitive. It must explain its decision and tell you about your right to complain.
Some information may be withheld under exemptions, such as legal advice covered by privilege, information about other people, crime prevention, and some confidential references. The organisation should tell you if it is relying on an exemption, unless that would itself undermine the exemption.
If they don't respond or you're unhappy
- Write to the organisation, quoting the date of your request and the deadline, and ask it to respond.
- Use its formal complaints process if it has one.
- If that does not work, complain to the Information Commissioner's Office (ICO), the UK regulator. The ICO can order compliance, though it does not award compensation.
- You can also apply to court for an order, and claim compensation for damage or distress caused by a breach of data protection law. Get advice first.
A template you can adapt
"I am making a subject access request under Article 15 of the UK GDPR. Please provide a copy of all personal data you hold about me, together with the supporting information listed in Article 15. My details are: [name, address, account number]. To help you find the information, I am particularly interested in [dates/topics]. Please send it to me electronically at [email]. I look forward to your response within one month."
Frequently asked questions
Can I ask on someone else's behalf?
Yes, with their authority, for example a signed letter. Parents can often make a request for a young child.
Can an employer refuse because there is a dispute?
No. A dispute or potential legal claim is not in itself a reason to refuse.
Sources and further reading
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.