Subject Access Request (SAR) — 2026 UK GDPR Guide

A Subject Access Request is the most powerful disclosure tool available to an individual — free, statutory, broad, and enforceable. It is used in employment disputes, family court proceedings, medical negligence claims, police complaints, and financial disputes. Most recipients underestimate how much it will turn up.

The legal basis

• Article 15 UK GDPR — right of access
• Section 45 DPA 2018 — additional rights
• Article 12 UK GDPR — transparency obligations
• ICO guidance on SARs — practical application

Structure — the Litigant Standard

1. Clear identification of yourself

Full name, date of birth, address(es) at relevant times, any account numbers or identifiers used in the controller’s systems.

2. Specific request

“I request under Article 15 UK GDPR all personal data you process relating to me, together with the information prescribed by Article 15(1)(a)–(h).”

3. Scope (where helpful)

“Including but not limited to: correspondence, file notes, internal emails referring to me, call recordings, CCTV, information held by third parties on your behalf, automated decisions taken in respect of me.”

4. Time period

All data held at the date of the request (UK GDPR). For employment disputes, specify the relevant employment period.

5. Format

“Provide by [email / post]. Electronic format where possible.”

6. Timeline

“I expect receipt within 1 month of this request under Article 12(3) UK GDPR. If an extension is required under Article 12(3) second paragraph, please notify me within that first month.”

Common excuses — how Chris defeats them

• “Too broad” — SAR can be broad. Controllers have disproportionate effort exemption — high bar, not a default refusal.
• “Verify identity” — legitimate but limited. Must not delay unreasonably. Two basic identifiers usually suffice.
• “Third party data” — controller must redact, not refuse in whole. Balancing test.
• “Commercially confidential” — not a recognised exemption against SARs.
• “Costs money” — first copy free under UK GDPR.

If they refuse or respond inadequately

• ICO complaint (free)
• County Court claim for compliance + compensation under Article 82 UK GDPR
• Injunction to compel compliance

Cross-use of SAR in other claims

• Employment tribunal — HR files, emails about you
• Police complaint — PNC entries, intelligence reports (subject to crime prevention exemption)
• Medical negligence — full medical records
• Family court — social services files
• Financial dispute — bank internal file notes

SAR material often becomes the exhibit bundle for the substantive claim.

Can Chris draft the SAR?

Yes. Tell Chris who you want data from and what the dispute is. Chris drafts a tightly scoped SAR with legal references, identity verification attachment, and escalation path. If the response is inadequate, an ICO complaint and an Article 82 damages claim follow.

Prepare to win. Plan not to fail.

Evidence wins cases. SARs generate evidence. Chris generates SARs.

Related Court Forms & Guides

• Right to Erasure (GDPR Article 17)
• GDPR Erasure Request Letter
• ICO Complaint: Data Protection Breach
• Personal Data Breach Notification
• Civil Court Forms Index

The GDPR request forms

Subject access request (SAR) form · erasure request form · ICO complaint form

Frequently asked questions

What is a Subject Access Request?

A SAR is the right of access under Article 15 UK GDPR — a free, statutory and enforceable way for an individual to obtain the personal data a controller processes about them. It is one of the most powerful disclosure tools available, used in employment disputes, family court proceedings, medical negligence claims, police complaints and financial disputes.

What should a SAR contain?

Clear identification of yourself (full name, date of birth, relevant addresses and any account identifiers); a specific request under Article 15 UK GDPR for all personal data plus the information prescribed by Article 15(1)(a)–(h); the scope where helpful (correspondence, file notes, internal emails, call recordings, CCTV and so on); the time period; the format you want it in; and the response timeline.

How long does a controller have to respond?

The page states you should expect receipt within one month of the request under Article 12(3) UK GDPR. If an extension is required under the second paragraph of Article 12(3), the controller should notify you within that first month. Check the current position for your situation.

Can a controller refuse because the request is “too broad” or “commercially confidential”?

A SAR can be broad. There is a disproportionate-effort exemption, but it is a high bar — not a default refusal. “Commercially confidential” is not a recognised exemption against SARs, and the first copy is free under UK GDPR. Where third-party data is involved, the controller must redact rather than refuse in whole, applying a balancing test.

What can I do if the response is inadequate or refused?

The page sets out the escalation routes: a free ICO complaint; a County Court claim for compliance and compensation under Article 82 UK GDPR; and an injunction to compel compliance.

Can Chris draft the SAR for me?

Yes. Tell Chris who you want data from and what the dispute is, and Chris drafts a tightly scoped SAR with legal references, an identity-verification attachment and an escalation path. If the response is inadequate, an ICO complaint and an Article 82 damages claim can follow.

Related guides: N244 application notice · All civil court forms