A Subject Access Request gives you access to your personal data and information about how it is being used.
A Subject Access Request (SAR, sometimes called a DSAR) is the exercise of the right of access. It can be made verbally or in writing and does not require special wording, a form or the phrase “Article 15”. The organisation must recognise the substance of the request.
A SAR is not limited to a customer-service account printout. Depending on what the organisation holds, personal data can appear in emails, CRM notes, complaint files, call recordings, chat logs, CCTV, internal messages, account history, audit logs and other systems. The organisation must make a reasonable and proportionate search.
Key points
- The standard response period is one calendar month, subject to current rules on ID, clarification and valid extensions.
- The right covers personal data, not necessarily whole documents as documents.
- The response should also include supplementary information such as purposes, recipients/categories, retention information and source where applicable.
- Third-party rights and statutory exemptions can justify redaction or withholding of some information.
- A weak or incomplete response can be challenged before going to the ICO.
Current 2026 position
The ICO updated subject-access guidance in July 2026.
The ICO’s 16 July 2026 guidance reflects changes under the Data (Use and Access) Act 2025. ConsumerWise therefore treats clarification, reasonable searches, response timing and extensions using the current post-DUAA framework rather than older copied wording.
See the Information Rights hub for SAR, FOI and EIR routes together.
What are you actually entitled to?
You are entitled to confirmation whether your personal data is being processed, access to that personal data, and specified contextual information about the processing. If an email contains one paragraph about you and ten paragraphs about someone else, the right focuses on the personal data relating to you; the organisation may redact or extract where necessary.
What should the organisation search?
Current ICO guidance requires a reasonable and proportionate search. That still means reasonable efforts to locate relevant personal data across likely systems. An organisation can consider the volume and difficulty of searching, but it must be able to justify why a search would be unreasonable or disproportionate. It should not simply search one convenient database if other obvious repositories are likely to contain relevant data.
Email and internal records
Emails are not automatically disclosable in full simply because your name appears in them, but personal data about you within them can fall within the SAR. Search terms, custodians, date ranges and system locations can therefore become important in an incomplete-response dispute.
Format and security
If you make the request electronically, the response will normally be supplied in a commonly used electronic format unless you ask otherwise. The organisation should provide the information securely and in a form that is intelligible and accessible.
In practice
- Define the categories that matter to you without unnecessarily narrowing away relevant data.
- Include useful identifiers, account numbers, old email addresses or date ranges if they genuinely help locate your data.
- Keep proof of the request and every later ID/clarification exchange.
- When reviewing the response, compare it against known events and records rather than only counting pages.
What to do
A practical next-step plan
- Send a clear SAR and keep proof of receipt.
- Respond promptly to proportionate ID or reasonably required clarification requests.
- Calculate the deadline using the current ICO rules.
- On receipt, inventory what was supplied and compare it with known categories of data.
- Challenge specific missing categories, unexplained redactions or missing supplementary information.
- Escalate unresolved handling to the organisation’s data-protection complaints process and then the ICO where appropriate.
Common traps
Things that often confuse the issue
- A “SAR pack” is not automatically complete because it is large.
- Do not demand “all documents” when your legal right is to personal data; describe the data or context you seek.
- Do not assume a company can force you to use its preferred webform.
- Do not overlook hidden attachments, spreadsheets, audio files or links with short expiry periods.
Evidence worth keeping
The practical boundary
A SAR gives access to personal data and prescribed information about its use. It is not a general disclosure process and does not automatically produce every document mentioning you. Equally, an organisation cannot reduce the right to a convenient account printout. The task is to locate and communicate your personal data after reasonable and proportionate searches.
Questions the organisation should be able to answer
- Which identities, account numbers, dates and systems help locate the data?
- Does the response include purposes, categories, recipients, retention, source and rights information?
- Were audio, messages, attachments, audit trails and complaint systems considered?
- Are redactions explained well enough to understand the type of restriction?
- Is the response intelligible, secure and in a usable electronic format?
Route examples
| Situation | Best next step |
|---|---|
| You want the content of complaint calls | Ask for recordings, transcripts, call notes and metadata within a stated period. |
| You want evidence for litigation | A SAR may still be valid, but it is not a substitute for court disclosure. |
| You dispute a decision as well as wanting the data | Use a SAR for access and the relevant complaint or appeal route for the decision itself. |
Useful wording
“This is a subject access request for my personal data. Please search the systems reasonably likely to hold the categories listed below and provide the Article 15 supplementary information. If anything is withheld, please identify the nature of the restriction and legal basis so far as you lawfully can.”
Official sources
Check the rules behind this guide
These are official or primary sources for this topic. Rules, scheme terms and deadlines can change, so check the live source before relying on a formal time limit or procedure.