Tell us what went wrong and we'll look into it. We'll be in touch as soon as we can.
Your name and email will only be used to respond to your report. See our Privacy Policy.
Share Your Feedback
Good or bad, we'd love to hear what you think. No strings attached.
Your feedback helps us make the site better for everyone. See our Privacy Policy.
Subject Access Guide
How Do I Make a Subject Access Request?
Getting a copy of your personal information from an employer, company or public body: how to ask, the one-month deadline, ID, fees, what can be held back and how to complain.
Last reviewed: 25 September 2026Sources: listed at the end, each checked on the date shownEngland, Wales, Scotland and Northern Ireland
Who this guide is for
You want a copy of the personal information an organisation holds about you: for example your employer or a former employer, a company, a school, a council, the NHS or the police. Asking for it is called a subject access request (SAR). The right comes from UK data protection law (the UK GDPR and the Data Protection Act 2018) and is the same in England, Wales, Scotland and Northern Ireland. The Information Commission (the data protection regulator, which replaced the Information Commissioner's Office on 30 September 2026) covers the whole UK.
This guide is about getting a copy of your own information. It does not work out any other claim or time limit, such as an employment tribunal claim.
In Scotland, a complaint about a subject access request also goes to the Information Commission, including one about a Scottish council. The Scottish Information Commissioner deals only with freedom of information requests to Scottish public bodies, not with personal information or subject access requests. The SPSO deals with service complaints, not data protection.
What this guide does not cover
Freedom of information requests (official information that is not about you): this guide does not cover them.
A data breach, having your information corrected or deleted, and unwanted marketing: this guide does not cover the rules. Ask the Information Commission. Letters you can adapt: data breach, deleting your data and stopping marketing.
Information about a child: whether a child can make their own request, or a parent can make it for them, follows rules that differ in different parts of the UK. Ask the Information Commission.
Health records, credit files, school records and social work records: special rules apply. Ask the Information Commission.
Records about someone who has died: this guide does not cover them. Ask the organisation or the Information Commission.
How each exemption works in detail, and how much compensation a court might award: ask the Information Commission or an independent legal adviser.
Problems at work such as a dismissal, discrimination or unpaid wages, and their time limits: see our employment rights guide.
At a glance
You have the right to a copy of your personal information, and to other information about how it is used.
You can ask in writing or by speaking to them, including on social media. You do not need a form or special words, and you do not have to mention the law.
In most cases it is free.
They must reply without undue delay, and at the latest within one month of getting your request.
They can take up to two more months if the request is complex or you have made several requests, but only if they tell you within the first month, and why.
They must make a reasonable and proportionate search. They can hold information back only if an exemption applies, and they must tell you why.
If you are unhappy, complain to the organisation first, then to the Information Commission. The Information Commission can act against the organisation but cannot pay you compensation.
What the rules depend on
What date did the organisation get your request? If they asked for ID or a fee, what date did they get it?
Did they ask you to explain what information you want, and when did you answer?
Did they tell you within the first month that they need longer, and why?
Have they replied, refused, or sent only part of your information?
Have you complained to the organisation yet?
What you can ask for
Confirmation of whether they are using your personal information.
A copy of that information.
Other information about it: why they use it, what kinds of information it is, who they share it with, how long they will keep it (or how they decide that), where they got it if not from you, and whether they make automated decisions about you, including profiling.
A reminder of your rights: in some cases to have it corrected or deleted, to limit its use or object to it, and in all cases to complain to the Information Commission.
How to make a request
Ask the organisation that holds the information. You can write (a letter, an email or an online form), ask in person or by phone, or ask on social media.
You do not need a form or particular words, you do not have to mention the law, and you do not have to send it to a particular person. It is enough that it is clear you are asking for your own information.
If you want particular information, say so. If your request is vague or they hold a lot about you, they can ask you to clarify, and the clock pauses while they wait for your answer.
A letter or email gives you a dated record of what you asked for and when.
Someone else, such as a relative, a friend or a solicitor, can make the request for you. It is up to them to show they have your authority.
They can ask for ID if they need to be sure who you are. They should only ask for what is reasonable and proportionate, and only for formal ID if it is necessary.
If they ask for ID, the month starts when they get it. If someone made the request for you, it starts when they get proof of that person's authority.
They should only ask you to clarify your request if it is reasonably needed. The month pauses on the day they ask and starts again the day after they get your answer.
They cannot force you to narrow your request. If you repeat it, they must make a reasonable search.
Fees
In most cases they cannot charge a fee.
They can charge a reasonable fee for their admin costs only if the request is manifestly unfounded or excessive, or you ask for further copies. They should explain the costs, and the month starts when they get the fee.
If you do not reply to a request for a fee, it is generally reasonable for them to close your request after one month.
The deadline
They must reply without undue delay, and at the latest within one month.
The month starts on the day they get your request, whether or not it is a working day, and ends on the same date in the next month. For example, a request they got on 5 March is due by 5 April.
If the next month has no such date, the deadline is the last day of that month. For example, a request they got on 31 August is due by 30 September.
If the deadline falls on a weekend or bank holiday, they have until the next working day.
If the request is complex, or you have made several requests, they can take up to two more months: up to three months in all from the day they got it. They must tell you within the first month that they are taking longer, and why. If they did not, the one-month date stands.
What they can hold back
They must make a reasonable and proportionate search. They do not have to make searches that are unreasonable or out of proportion to the importance of the information.
They can refuse all or part of a request only if an exemption or restriction applies, and they must be able to justify it.
Information about other people: they do not have to give it unless that person agrees or it is reasonable to give it without their agreement.
Other exemptions that often come up include legal advice (legal professional privilege), confidential references, management information, negotiations with you, crime and taxation, and exam scripts and marks.
A manifestly unfounded or excessive request can be refused or charged for, but the bar for that is high.
If they refuse, they must tell you why, and tell you about your right to complain to them, to complain to the Information Commission and to go to court.
How you get the information
If you asked electronically, they must give it to you in a commonly used electronic format unless you ask for something else.
It must be clear and easy to understand, and they must take reasonable steps to send it securely.
They can give you secure online access instead, but you must be able to download a copy, and they must use another way if you cannot or do not want to use it.
Nobody can force you to make a request
It is a criminal offence for someone to make you use a subject access request to get records about you (for example of convictions, cautions or your health) so that they can see them, for example before giving you a job or an insurance contract.
If it is your employer
The same rules apply to your employer or a former employer. If you want particular emails, notes or records, say so.
Information about colleagues, legal advice and confidential references may be held back if an exemption applies.
Employment tribunal time limits do not wait for your subject access request. If you have a work claim, check its time limit now with the employment rights guide.
If they do not reply or you are unhappy
In most cases the Information Commission recommends that you complain to the organisation first and give it the chance to put things right.
From 19 June 2026 every organisation must give you a way to make a data protection complaint to it, acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome.
The 30 days start the day after they get your complaint. If the last day is a weekend or public holiday, they have until the next working day. Acknowledging your complaint is not the same as resolving it.
If you are still unhappy, you can complain to the Information Commission. The Information Commission cannot award compensation, even when it says an organisation has broken data protection law.
You can also go to court to make the organisation comply, to claim compensation for damage (including distress), or both. The organisation may agree to pay without a court claim. The Information Commission strongly recommends independent legal advice before any court claim.
This guide gives no time limit for complaining to the Information Commission or for a court claim: ask the Information Commission or an adviser.
Deadlines
Reply to your request: without undue delay, and within one month of them getting it (or the ID, proof of authority or fee they asked for).
Longer time: up to two more months (three in all), only if they told you within the first month, with reasons.
Clarifying your request: the month pauses from the day they ask until the day after they get your answer.
A request for a fee you do not answer: they can generally close your request after one month.
Your complaint to the organisation: acknowledged within 30 days.
This guide gives no time limit for complaining to the Information Commission or going to court.
Money figures
This guide gives no money amounts. A request is free in most cases; any fee must be reasonable and explained. Compensation is agreed with the organisation or decided by a court.
Where to go for help
Information Commission: 0303 123 1113, Monday to Friday 9am to 5pm (not bank holidays), or live chat at ico.org.uk. It covers the whole UK.
Citizens Advice (England): 0800 144 8848
Citizens Advice (Wales): 0800 702 2020
Citizens Advice Scotland: 0800 028 1456
Advice NI: 0800 915 4604
Traps
The month runs from when they got your request, not when you sent it, and the day they got it counts.
Asking for ID, a fee or a clarification can make the deadline later. Reply quickly.
A longer deadline only counts if they told you within the first month, and why.
Information about other people may be blacked out or held back.
Complaining to the Information Commission does not get you compensation.
Keep a copy of your request and a note of the date they got it.
Sources (checked 25 September 2026)
ico.org.uk: A guide to subject access (for organisations, last updated 16 July 2026, reflects the Data (Use and Access) Act 2025; checked 25 Sep 2026): requests verbal or in writing incl. social media; no set form of words, no need to cite legislation or a named contact; third party (relative, friend, solicitor) must evidence authority; children: competence, rules differ in different parts of the UK; comply without undue delay and within one month of receipt, or of receiving ID / proof of authority / a fee; extension up to a further two months if complex or a number of requests, must tell the person and why within one month; clarification only if reasonably required, clock pauses the day it is asked and resumes the day after the answer, cannot force a narrower request; no fee in most cases, reasonable fee if manifestly unfounded or excessive or further copies, explain costs, generally reasonable to close after one month without a reply; ID reasonable and proportionate, formal ID only if necessary, timescale starts on receipt; must make a reasonable and proportionate search; electronic request = commonly used electronic format; clear and accessible; security; remote access with download and an alternative; exemptions justified case by case (list incl. legal professional privilege, management information, negotiations with the requester, confidential references, exam scripts and marks, crime and taxation, information about other people); refusal must give reasons + right to complain to the controller, to the Information Commission and to the courts; third-party information only with consent or where reasonable; special cases (unstructured manual records, credit files, health, educational, social work); high threshold for manifestly unfounded or excessive; enforced SAR is a criminal offence.
UK GDPR Article 15(1)(a)-(h) (legislation.gov.uk, the Article the Information Commission guide cites): confirmation, copy, purposes, categories, recipients, retention period or criteria, rights to rectification / erasure / restriction / objection, right to complain to the Commissioner, source, automated decision-making incl. profiling (list as set out on the NI Policing Board SAR page, checked 25 Sep 2026).
Calculating the month (ICO right of access guidance, as quoted by RPC 21 Jan 2020, Ward Hadaway and A&L Goodbody 3 Sep 2019): starts on the day of receipt whether or not a working day, ends on the corresponding calendar date; no such date = last day of the following month (31 Aug -> 30 Sep); weekend or public holiday = next working day. Checked on the Information Commission detailed page 14 Oct 2026 (the Information Commission says this guidance is under review after the Data (Use and Access) Act).
ico.org.uk: How to make a data protection complaint to an organisation (for the public, checked 25 Sep 2026): 30 days to acknowledge, starting the day after receipt; weekend or public holiday = next working day; acknowledging is not resolving; look into it, keep you updated; complaining for someone else needs authority.
ico.org.uk: How to deal with data protection complaints / Complaints guidance for organisations (DUAA 2025 inserts s164A into the DPA 2018): give people a way to complain, acknowledge within 30 days, respond without undue delay and keep people informed, tell them the outcome without undue delay. In force 19 June 2026: Gowling WLG and Michelmores 2026, digit.fyi (ICO statement), ICO Data Protection Review Guide (signed off 18 Jun 2026, applies from 19 Jun 2026).
ico.org.uk: Check if you can complain (make-a-complaint/data-protection-complaints): in most cases raise the concern with the organisation first; 0303 123 1113 or live chat. ico.org.uk/concerns: helpline Monday to Friday 9am to 5pm, excluding bank holidays. GOV.UK Data protection - make a complaint: Information Commission 0303 123 1113.
ico.org.uk: Taking your case to court and claiming compensation + Are there other routes I can take? (checked 25 Sep 2026): court to enforce your rights, claim compensation, or both; material and non-material damage (distress); the Information Commission cannot award compensation even when it gives an opinion that the law was broken; the organisation may agree to pay; strongly recommends independent legal advice.
Scotland line as in our data protection guide's Scotland rules (checked 20 September 2026, pre-flight guard P29): the Information Commission for SARs incl. Scottish councils; Scottish Information Commissioner FOI to Scottish public bodies only; SPSO service complaints, not data protection.
Help lines: Citizens Advice England 0800 144 8848, Wales 0800 702 2020, Citizens Advice Scotland 0800 028 1456, Advice NI 0800 915 4604.
Important disclaimer: This guide covers the right of access to your own personal information (subject access requests) under the UK GDPR and the Data Protection Act 2018, for people in England, Wales, Scotland and Northern Ireland as at 25 September 2026. General legal information only, not legal advice. ukworkrights.co.uk, Not a law firm.