What is a data subject access request?
Definition
A data subject access request (DSAR) is a request you make to an organisation to get a copy of the personal data it holds about you. In the UK it's your right of access under UK GDPR, and it's usually free.
- Category
- Privacy
- Also called
- DSAR, subject access request, SAR
- Last updated
A data subject access request, also called a subject access request or SAR, is how you use your right of access. The ICO, the UK data protection regulator, describes the right as your entitlement to find out what personal data an organisation holds about you and to get a copy.
How to make one
Anyone can make a request, and you don't need a solicitor. The ICO says it can go online through many organisations' websites, by email, by post, over the phone or face to face. It helps to put "subject access request" in the subject line, give enough details for the organisation to find you, and say what information you want. If you're asking for someone else's data, you need to show you have their permission.
How long it takes and what it costs
Organisations normally have one month to reply. The clock may not start until they have what they need from you, and for complex or multiple requests they can take up to two more months. In most cases they can't charge a fee, except where a request is manifestly unfounded or excessive, or you ask for further copies of what you've already received.
If a month has passed with no answer, the ICO's advice is to send a follow-up email or letter. You can complain to the ICO if you're still unhappy.
What you get back
A copy of your personal data and information about how it's used. Some information can be withheld under exemptions, for example where it would reveal details about other people.
DSAR vs. an opt-out or deletion request
A DSAR asks what the organisation holds. It doesn't make them delete anything. To have data removed you send a separate erasure request, or use the company's opt-out process.
EU and UK rules give this right. The US has no single equivalent, though some state laws give similar access rights.
How to protect yourself
- 1
Send your request in writing and keep a copy
Email works well. Put "subject access request" in the subject line and save the date you sent it, because the one-month clock runs from receipt.
- 2
Be specific about what you want
Say which accounts, dates or departments. Vague requests are slower and can be queried.
- 3
Chase after a month
If you've heard nothing after a month, send a follow-up. If that fails, you can complain to the ICO.
- 4
Follow up with an erasure request if needed
Once you can see what they hold, ask for what you don't want kept deleted.
- 5
Find the companies you don't know about
You can only ask companies you know hold your data. Serus finds the data brokers and people-search sites that list you and removes your listings.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Do I have to pay for a DSAR?
Usually not. The ICO says organisations can't normally charge a fee, except where a request is manifestly unfounded or excessive, or you ask for further copies.
How long do they have to respond?
Normally one month. It can be extended by up to two more months for complex or multiple requests.
Do I need a solicitor?
No. Anyone can make a SAR themselves.
Can I make a DSAR for someone else?
Yes, with their permission. You need to show the organisation you're authorised to ask.
Sources
Something wrong or out of date? Tell us and we'll re-check it.