Subject Access Request | ConsumerWise

Choose the scope

A broad SAR and a targeted SAR do different jobs.

A Subject Access Request (SAR) is for your personal data. You do not need special wording, but a written request creates a useful record. The organisation must make a reasonable and proportionate search; it may ask for clarification where reasonably required, but it cannot simply force you to narrow a valid request.

Use the broad version when you do not yet know which systems contain the important records.
Use the targeted version when you know the account, event, date range or category you need.
Add identifiers that help locate your data, but do not send unnecessary ID unless reasonably requested.

Editable template

Version 1: broad Subject Access Request

Use this when you want a useful cross-system disclosure and do not want to guess where the organisation stores your data.

How to edit it: replace everything in square brackets with your own details. If a bracketed paragraph does not apply, delete it before sending.

Subject: Subject Access Request: [your name / account reference]

Dear Data Protection Team,

I am making a Subject Access Request for my personal data.

My details
Name: [your full name]
Account/customer/reference number: [reference, if applicable]
Email/phone used on the account: [details]
Previous relevant name/address: [only if needed to locate records]

Please provide a copy of the personal data you process about me, together with the supplementary information required by the right of access.

Please include personal data reasonably falling within these categories where held:
• account, profile and customer records;
• correspondence, complaints, internal notes and case records;
• call recordings, transcripts, call notes and contact logs;
• decisions, flags, status codes, audit/history records and changes made to my account;
• personal data about me in relevant emails, messaging systems or workflow systems; and
• [add any particular category important to your case].

Relevant period: [date range, or write “the period for which you hold my personal data” if you do not want to limit it].

If you need information to confirm my identity, please ask promptly and keep the request proportionate. If you consider clarification reasonably required, please explain what is unclear or what information you hold in large quantities so I can consider the request.

Please provide the response electronically in a commonly accessible format.

Yours faithfully,
[Your name]

Editable template

Version 2: targeted Subject Access Request

Use this when you know exactly what event or record set you need and a narrower request will make the search clearer.

How to edit it: replace everything in square brackets with your own details. If a bracketed paragraph does not apply, delete it before sending.

Subject: Targeted Subject Access Request: [event/account/reference]

Dear Data Protection Team,

I am making a Subject Access Request for personal data relating to [specific event, transaction, complaint or account].

My details
Name: [your full name]
Account/reference: [reference]
Relevant dates: [date range]

In particular, please provide my personal data contained in or associated with:
1. [specific call / complaint / order / application / account event];
2. [internal notes, decision records, audit trail or status history relating to that event];
3. [emails/messages about you or the event where you are identifiable]; and
4. [any other specific category].

For clarity, I am asking for my personal data within these records, not merely copies of documents that happen to mention the account.

[Optional: I am aware of [specific record, call, email or system entry] dated [date], which may assist your search.]

If any requested personal data is not provided because an exemption or restriction is relied on, please give enough information for me to understand the basis of that decision where the law permits.

Please provide the response electronically in a commonly accessible format.

Yours faithfully,
[Your name]

Timing

Do not calculate the deadline from habit.

The normal response period is one month, but identity checks, fees in limited circumstances, valid clarification and permitted extensions can affect the date. Use the SAR deadline calculator if the timing matters.

Official & related guidance

Check the route that applies to your situation.

Check the linked guidance before sending. Rules, complaint stages and time limits can differ by sector.