Request letter templates

UK subject access request template: a SAR letter you can copy

Quick answer

Copy the letter below, fill in the [brackets] and send it to the organisation by email or post. Anyone can make a subject access request (SAR) without a solicitor, it's normally free, and the organisation usually has one month to reply. If you'd rather not write it yourself, the ICO's free SAR service creates and sends the email for you.

“Anyone can make a SAR. You don’t need a solicitor or a lawyer.”

All privacy laws
Applies in
United Kingdom
In force since
Companies must answer within
One month from the latest of: receiving your request, receiving any ID or information it reasonably asked for, or receiving any fee it's allowed to charge. It can extend by two months for complex or numerous requests if it tells you why within the first month. Since 5 February 2026 the clock also stops while it waits for you to clarify a request (UK GDPR Articles 12 and 12A).
Regulator
Information Commission (ICO)
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: ico.org.uk, legislation.gov.uk

Last verified against the official page:

How we research this Report an error

Anyone whose personal data is held by an organisation covered by the UK GDPR: such as companies, employers and the NHS. You can also make a SAR for someone else with proof of their permission, such as written permission or a power of attorney.

Your rights

  • Right of access

    Confirmation that the organisation holds your data, a copy of it, and supporting information such as the purposes, who it was shared with, how long it's kept and where it came from. Access covers what a reasonable and proportionate search finds (Article 15).

  • Normally free

    A reasonable fee is allowed only for manifestly unfounded or excessive requests, or for further copies (Article 12).

  • A one-month time limit

    One month, extendable by two for complex or numerous requests, with the clock running from when the organisation has your request and any ID it reasonably asked for (Article 12A).

  • Complain to the organisation first

    You can make a data protection complaint to the organisation, which must acknowledge it within 30 days, before going to the ICO (Data Protection Act 2018, s. 164A).

General information, not legal advice.

How to use it

  1. 1

    Find the right contact

    Use the contact in the organisation's privacy notice or on its website. You can send it to any part of the organisation; it doesn't have to reach a specific person to count. You can also ask online, by phone or in person, but writing gives you a record.

  2. 2

    Or use the ICO's free SAR service

    The ICO's make a subject access request service asks you a few questions, then creates and sends the email for you. Use it if you'd rather not edit a letter.

  3. 3

    Send it and keep a record

    Screenshot online forms before you submit them. Keep sent emails, copies of letters and proof of postage. For a phone request, note the date and the name of the person you spoke to.

  4. 4

    Provide ID only if reasonably asked

    Expect an ID check if you've asked for sensitive information or if your details don't match its records. The organisation should only ask for enough to confirm it's you, and the month starts once it has it.

  5. 5

    Wait one month, then complain

    If nothing arrives, or the answer is incomplete, make a data protection complaint to the organisation. It must acknowledge it within 30 days. If you're still unhappy, complain to the ICO through its data protection complaints page. Our UK GDPR page explains what to include.

No answer in time? Complain to Information Commission (ICO) .

The letter

Fill in the parts in [brackets] before you send it. 

Subject: Subject access request

[Your full name]
[Your home address]
[Your email address and phone number]
[Date]

To: [Organisation name], data protection or privacy team
[Organisation postal address or privacy email address]

Dear [Organisation name],

I am making a subject access request under Article 15 of the UK GDPR for the personal information you hold about me.

To help you find my information:
- Name(s) I have used: [current name and any previous names, such as a previous surname]
- Customer account, NHS, employee or other reference numbers: [numbers, if any]
- Other details that will help: [for example, the branch or department I dealt with]

The information I want:
[Be specific, for example: "emails and notes about my complaint of [date]" or "my account history from [date] to [date]".]
[Optional: I don't need [for example, marketing emails you sent me].]
[Optional: I'm asking because [reason]. You don't need a reason, but it can help the search.]

Please also tell me:
1. why you are using my information;
2. who you have shared it with;
3. how long you will keep it;
4. where you got it, if not from me;
5. whether you use it for automated decision-making, including profiling.

Please send the information [by email to the address above] [as printed copies to my home address]. [Optional: I need it in [large print / another accessible format].]

Please respond within one calendar month of receiving this request. If you need to confirm my identity, please ask only for what you need to be sure it's me.

If I am not satisfied with your response, I will raise a data protection complaint with you and, if necessary, with the Information Commission.

Yours faithfully,

[Your name]

Narrow beats broad

You can ask for everything, and sometimes that's what you need. But the ICO's advice is to be specific: say what you want, what you don't need, and give dates or details that help the search. A request for "all emails about my grievance between March and June" will come back faster than "everything you hold". Since the Data (Use and Access) Act, the organisation only has to make a reasonable and proportionate search, so a clear request also leaves less room for argument about what that means.

Giving a reason is optional. It can help the organisation find what matters to you.

The clock, in plain terms

The month starts on the latest of three dates: when the organisation got your request, when it got any ID it reasonably asked for, and when it got any fee it's allowed to charge. If it asks you to clarify what you want, the clock stops until you answer. That's been the rule since 5 February 2026, under Article 12A. It can add two more months for complex or numerous requests, but only if it tells you why within the first month.

Put the date you sent it in your calendar, plus one month.

After the copy arrives

A SAR shows you what an organisation holds and where it got it. If you then want it deleted, our UK erasure request template covers that, with a direct marketing objection the organisation can't refuse. Our guide to removing your personal information in the UK covers the electoral register and Companies House too.

Where Serus fits

A SAR tells you what one organisation knows. Data brokers and people-search sites are many organisations, and most people want their data gone, not copied back to them. Serus finds the ones that list you where you live, sends the removal requests and follows up when deadlines pass. For one company, this letter is all you need. Run a free scan to see where else you're listed.

Data brokers that list people in United Kingdom

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

Can I ask for everything an organisation holds about me?

Yes, but some information may be withheld, and a broad request can take longer. Being specific usually gets a faster, more useful reply.

Can I make a SAR for someone else?

Yes, with proof of their permission, such as written permission or a power of attorney.

Is there an official SAR tool?

Yes. The ICO's free subject access request service creates and sends the email request for you.

How far does the organisation have to search?

Since the Data (Use and Access) Act, access covers what a reasonable and proportionate search finds (UK GDPR Article 15(1A)).

Can the organisation stop the clock?

Yes. Since 5 February 2026 the time it spends waiting for you to clarify your request doesn't count towards the month. It can also extend by two months for complex or numerous requests if it tells you why within the first month.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.