The clock starts the day your request lands, and it runs for one month. Not a month from when someone gets round to reading it — one month from receipt, and it costs you nothing.
You have the letter in front of you. The one with the decision that didn’t add up. Somewhere in a phone call, weeks ago, a voice told you it was “on your file” and moved on, as if the file were a fact of nature rather than a thing about you that you are entitled to see.
So you call. You are transferred. You are told to email a general inbox. The email is answered by a signature block and a promise to escalate. A form is mentioned that no one can quite locate. Nobody is rude. That is almost the worst of it — everybody is helpful, and nothing happens, and the file stays exactly where it was.
Here is the thing the switchboard doesn’t tell you. You do not need their form. You do not need a reason. What you are making is a subject access request — your right, under the UK GDPR and the Data Protection Act 2018, to a copy of the personal data an organisation holds about you. It does not have to be on headed paper. It does not have to use the words “subject access request,” though saying so removes any doubt. It has to be clear: you are the person the data is about, you are asking for your personal data, and here is where to send it.
And it is free. In almost every case an organisation cannot charge you a penny. There is a narrow exception — a request that is “manifestly unfounded or excessive” — but that is a bar they have to clear with evidence, not a mood they can be in. Wanting your own file is neither unfounded nor excessive. It is Tuesday.
The one-month clock is the part they rely on you not knowing. They must respond without undue delay and, at the latest, within one month of receiving your request. They can extend that — by up to two further months — but only where the request is genuinely complex or you’ve made several, and only if they tell you, inside that first month, that they’re doing it and why. Silence is not an extension. A backlog is not an extension. If the month runs out and nothing arrives, the deadline hasn’t moved. They’ve missed it.
Which is why the letter matters more than the phone call. A phone call is a memory. A dated letter is a record — it fixes the day the clock started, names what you’re asking for, confirms who you are, and gives them nowhere to file it but “answered.” Vague requests get vague replies, or none. Precision here isn’t aggression. It’s just harder to ignore.
This is the point where a blank page tends to win. You know what you want; you’re less sure how to say it so it can’t be waved away as too broad, or narrowed into uselessness. That’s the part to hand over. Tell Chris what happened, who holds the data, and what you’re trying to see. Chris turns it into a clean subject access request — the right statutory footing, your identifying details set out plainly, a specific description of the records you’re after, and a clear note of the one-month deadline so the recipient is in no doubt it has started. You read it. You send it. You keep the date.
Then you wait — but now you’re waiting against a line in the sand instead of a shrug.
And if that line is crossed — the month gone, the reply absent or gutted — you are not out of options, and you are not out of pocket. You can complain to the Information Commissioner’s Office, and the ICO takes complaints for free. Start with the plain-English guidance on GOV.UK, then take it to the ICO if you need to. No fee. No solicitor required to knock on that particular door.
The file was always yours. The letter is just the thing that makes them admit it.
Come back when you know what they’ve sent — the next letter writes itself from there.