Subject access request (UK GDPR Article 15)

When to use this

Use this when you want a copy of the personal data an organisation holds about you, and related information (for example why they process it and who they share it with). You can send it to the organisation’s Data Protection Officer if they publish one, or otherwise to the company secretary / a published privacy contact.

Time limit (official position)

Organisations must normally respond without undue delay and within one month. They can extend by up to a further two months for complex or multiple requests, but must tell you within the first month if they need more time and why. Under the Data (Use and Access) Act 2025, if they reasonably need clarification to identify the information or processing, they may ask you and the one-month clock pauses until you reply (“stop the clock”); they cannot force you to narrow the request. They must make a reasonable and proportionate search for your data — not every theoretically possible search. Requests are usually free; a fee may be charged if a request is manifestly unfounded or excessive, or for further copies. Sources: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/ and https://www.legislation.gov.uk/ukpga/2025/18/section/76

What to keep

• Proof of identity / address if the organisation asks for it (send securely)
• A copy of this request and the date you sent it
• Any acknowledgement, refusal or disclosure you receive
• Notes of phone calls

This is a template only. Free Legal Advice UK does not give advice on your situation. If you are unhappy with the response, the ICO explains how to complain. See free legal help.

Letter / email

To: [Data Protection Officer / Company Secretary / privacy email]
Organisation: [Name and address]
From: [Your full name]
Address: [Your postal address]
Email / phone: [Contact details]
Date: [Date]

Subject: Subject access request under UK GDPR Article 15

Dear [Name / Data Protection Officer],

I am making a subject access request under Article 15 of the UK GDPR.

Please provide:

1. Confirmation whether you are processing personal data about me.
2. A copy of the personal data you hold about me.
3. The purposes of the processing.
4. The categories of personal data concerned.
5. The recipients or categories of recipient to whom the data have been or will be disclosed.
6. The envisaged retention period, or the criteria used to determine it.
7. Information about my rights to rectification, erasure, restriction and to object, and to complain to the Information Commissioner’s Office.
8. Where the data were not collected from me, any available information as to their source.
9. The existence of any automated decision-making, including profiling, and meaningful information about the logic involved (if applicable).

To help you locate my data, I enclose / provide:

• Full name: [ ]
• Previous names: [ ]
• Date of birth: [ ]
• Account / customer / reference number(s): [ ]
• Approximate dates of my relationship with you: [ ]
• Other identifiers: [e.g. email addresses, phone numbers used]
• Particular records I want (if known): [e.g. call recordings between dates X and Y; HR file; CCTV on date Z at location]

Please respond within one month, as required. If you need proof of identity, please say what you need. Please send the information securely to [email / postal address].

Yours faithfully,

[Your signature]
[Your printed name]

General information for England & Wales / UK data protection. Not legal advice. Checked 30 October 2026.

All template letters · Free legal help