A Subject Access Request gives you access to your personal data and information about how it is being used.
A Subject Access Request (SAR, sometimes called a DSAR) is the exercise of the right of access. It can be made verbally or in writing and does not require special wording, a form or the phrase “Article 15”. The organisation must recognise the substance of the request.
A SAR is not limited to a customer-service account printout. Depending on what the organisation holds, personal data can appear in emails, CRM notes, complaint files, call recordings, chat logs, CCTV, internal messages, account history, audit logs and other systems. The organisation must make a reasonable and proportionate search.
Key points
- The standard response period is one calendar month, subject to current rules on ID, clarification and valid extensions.
- The right covers personal data, not necessarily whole documents as documents.
- The response should also include supplementary information such as purposes, recipients/categories, retention information and source where applicable.
- Third-party rights and statutory exemptions can justify redaction or withholding of some information.
- A weak or incomplete response can be challenged before going to the ICO.
Current 2026 position
The ICO updated subject-access guidance in July 2026.
The ICO’s 16 July 2026 guidance reflects changes under the Data (Use and Access) Act 2025. ConsumerWise therefore treats clarification, reasonable searches, response timing and extensions using the current post-DUAA framework rather than older copied wording.
See the Information Rights hub for SAR, FOI and EIR routes together.
What are you actually entitled to?
You are entitled to confirmation whether your personal data is being processed, access to that personal data, and specified contextual information about the processing. If an email contains one paragraph about you and ten paragraphs about someone else, the right focuses on the personal data relating to you; the organisation may redact or extract where necessary.
What should the organisation search?
Current ICO guidance requires a reasonable and proportionate search. That still means reasonable efforts to locate relevant personal data across likely systems. An organisation can consider the volume and difficulty of searching, but it must be able to justify why a search would be unreasonable or disproportionate. It should not simply search one convenient database if other obvious repositories are likely to contain relevant data.
Email and internal records
Emails are not automatically disclosable in full simply because your name appears in them, but personal data about you within them can fall within the SAR. Search terms, custodians, date ranges and system locations can therefore become important in an incomplete-response dispute.
Format and security
If you make the request electronically, the response will normally be supplied in a commonly used electronic format unless you ask otherwise. The organisation should provide the information securely and in a form that is intelligible and accessible.
In practice
- Define the categories that matter to you without unnecessarily narrowing away relevant data.
- Include useful identifiers, account numbers, old email addresses or date ranges if they genuinely help locate your data.
- Keep proof of the request and every later ID/clarification exchange.
- When reviewing the response, compare it against known events and records rather than only counting pages.
What to do
A practical next-step plan
- Send a clear SAR and keep proof of receipt.
- Respond promptly to proportionate ID or reasonably required clarification requests.
- Calculate the deadline using the current ICO rules.
- On receipt, inventory what was supplied and compare it with known categories of data.
- Challenge specific missing categories, unexplained redactions or missing supplementary information.
- Escalate unresolved handling to the organisation’s data-protection complaints process and then the ICO where appropriate.
Common traps
Things that often confuse the issue
- A “SAR pack” is not automatically complete because it is large.
- Do not demand “all documents” when your legal right is to personal data; describe the data or context you seek.
- Do not assume a company can force you to use its preferred webform.
- Do not overlook hidden attachments, spreadsheets, audio files or links with short expiry periods.
Evidence worth keeping
Official sources
Check the rules behind this guide
These are official or primary sources for this topic. Rules, scheme terms and deadlines can change, so check the live source before relying on a formal time limit or procedure.