⚖ Important — Please Read Before Continuing

Scroll to the bottom to accept the disclaimer and access the tool

Scroll down to read the full disclaimer before accepting

1. This is guidance — and only ever guidance

Everything produced by ukworkrights.co.uk is general guidance. It is not legal advice. It is not a substitute for advice from a qualified solicitor. Never treat it as the final word — use it as a starting point, then check and take responsibility for any action you take.

2. AI can make mistakes

The guidance is generated by artificial intelligence. AI can and does make mistakes — wrong dates, wrong figures, wrong legal references, missed nuances. Read everything carefully. If the matter is serious, get it checked by ACAS, Citizens Advice, or a qualified solicitor before acting on it.

3. Verified figures and guidance sources

Statutory figures (such as rates for minimum wage, SSP, redundancy, pension contributions, council tax bands, flight compensation amounts, and benefit rates) are verified against GOV.UK, ACAS, Citizens Advice, and relevant regulatory bodies. Laws and rates change regularly. Always verify important figures at gov.uk before making decisions or taking action.

4. What happens to what you type

The situation you describe is sent to Anthropic, the provider of the AI model that writes your guidance. Anthropic is based in the United States, so your text is transferred outside the UK under the safeguards set out in our Privacy Policy. Anthropic acts on our instructions and does not use your text to train its models. It deletes the text automatically within 30 days, unless its safety systems flag it for possible misuse, in which case it can be kept for up to 2 years. We do not store the text you type once your session ends. The report written for you is kept for up to 90 days so we can check its accuracy — it carries no name or email address, but it may repeat details of your situation.

Because you describe your own situation in your own words, what you type may include information that data protection law treats as especially sensitive — for example health, disability, mental health, pregnancy, race, religion, sexual orientation, trade union membership, or criminal convictions and allegations. By ticking the box below you are giving your explicit consent to that information being processed in this way. You can withdraw at any time by not submitting a check.

Please do not include your name, address, or anyone else’s personal details. The checkers do not need them, and leaving them out protects you. Your report is written in neutral, plain English rather than repeating informal language, slang or strong emotion from your description.

5. Your responsibility

By using this service you accept that you will treat all output as general guidance only, verify important information with official sources, and seek professional legal advice for serious or complex matters. ukworkrights.co.uk and UK Work Rights Ltd accept no liability for any loss or damage arising from your use of or reliance on this service.

6. Useful Official Resources

ACAS — Free employment advice: 0300 123 1100 — acas.org.uk
Citizens Advice — Free legal guidance: 0800 144 8848 — citizensadvice.org.uk
GOV.UK — Official UK government guidance: gov.uk
ICO — Data protection queries: 0303 123 1113 — ico.org.uk
Financial Ombudsman — Financial disputes: 0800 023 4567 — financial-ombudsman.org.uk
Energy Ombudsman — Energy disputes: energyombudsman.org
NHS — Healthcare guidance: nhs.uk
Veterans UK: 0808 1914 218
Jobcentre Plus (existing benefit claims): 0800 169 0310

For personal injury claims, immigration advice, criminal matters, or complex legal situations — always consult a regulated solicitor. Find one at solicitors.lawsociety.org.uk or gov.uk/find-a-solicitor.

7. Scope of this service

This service covers a wide range of UK rights topics including employment, housing, benefits, consumer rights, driving, NHS complaints, data protection, tax, school rights, wills and probate, energy, travel, and more. For all topics, the guidance is general in nature. For regulated activities — including personal injury claims, immigration applications, criminal defence, and financial advice — you must use a regulated professional.

The law is not the same across the UK. England, Wales, Scotland and Northern Ireland differ — sometimes substantially — on housing, tribunals, employment procedure, benefits, education, and wills and probate. Your guidance is tailored to the nation you selected at the top of the page, so please make sure it is right before you rely on the answer. If you live in one nation and the matter arose in another, say so in your description. Where a rule applies in only part of the UK, the guidance should say so — if it does not, treat that as a reason to check with one of the services listed above.

I have read and understood the disclaimer. I accept that this service provides general guidance only and not legal advice, and I give my explicit consent to the information I type — which may include sensitive personal information — being sent to Anthropic in the United States to generate my guidance, and to the report written for me being kept for up to 90 days so its accuracy can be checked.

📄 Subject Access Guide

How Do I Make a Subject Access Request?

Getting a copy of your personal information from an employer, company or public body: how to ask, the one-month deadline, ID, fees, what can be held back and how to complain.

✅ Last verified: 25 September 2026 📚 Sources: listed at the end, each checked on the date shown 🇬🇧 England, Wales, Scotland and Northern Ireland

💬 Check your own situation

Describe what has happened. The checker answers only from this guide, plus what you tell it, and says so if something is not covered.

Check My Subject Access Request →

Who this guide is for

You want a copy of the personal information an organisation holds about you: for example your employer or a former employer, a company, a school, a council, the NHS or the police. Asking for it is called a subject access request (SAR). The right comes from UK data protection law (the UK GDPR and the Data Protection Act 2018) and is the same in England, Wales, Scotland and Northern Ireland. The Information Commissioner's Office (ICO) is the regulator for the whole UK.

This checker is about getting a copy of your own information. It does not work out any other claim or time limit, such as an employment tribunal claim.

In Scotland, a complaint about a subject access request also goes to the ICO, including one about a Scottish council. The Scottish Information Commissioner deals only with freedom of information requests to Scottish public bodies, not with personal information or subject access requests. The SPSO deals with service complaints, not data protection.

What this guide does not cover

Freedom of information requests (official information that is not about you): this guide does not cover them.
A data breach, having your information corrected or deleted, and unwanted marketing: this guide does not cover the rules. Ask the ICO. Letters you can adapt: data breach, deleting your data and stopping marketing.
Information about a child: whether a child can make their own request, or a parent can make it for them, follows rules that differ in different parts of the UK. Ask the ICO.
Health records, credit files, school records and social work records: special rules apply. Ask the ICO.
Records about someone who has died: this guide does not cover them. Ask the organisation or the ICO.
How each exemption works in detail, and how much compensation a court might award: ask the ICO or an independent legal adviser.
Problems at work such as a dismissal, discrimination or unpaid wages, and their time limits: use the employment rights checker.

⚖ At a glance

You have the right to a copy of your personal information, and to other information about how it is used.
You can ask in writing or by speaking to them, including on social media. You do not need a form or special words, and you do not have to mention the law.
In most cases it is free.
They must reply without undue delay, and at the latest within one month of getting your request.
They can take up to two more months if the request is complex or you have made several requests, but only if they tell you within the first month, and why.
They must make a reasonable and proportionate search. They can hold information back only if an exemption applies, and they must tell you why.
If you are unhappy, complain to the organisation first, then to the ICO. The ICO can act against the organisation but cannot pay you compensation.

The questions that decide the answer

What date did the organisation get your request? If they asked for ID or a fee, what date did they get it?
Did they ask you to explain what information you want, and when did you answer?
Did they tell you within the first month that they need longer, and why?
Have they replied, refused, or sent only part of your information?
Have you complained to the organisation yet?

What you can ask for

Confirmation of whether they are using your personal information.
A copy of that information.
Other information about it: why they use it, what kinds of information it is, who they share it with, how long they will keep it (or how they decide that), where they got it if not from you, and whether they make automated decisions about you, including profiling.
A reminder of your rights: in some cases to have it corrected or deleted, to limit its use or object to it, and in all cases to complain to the ICO.

How to make a request

Ask the organisation that holds the information. You can write (a letter, an email or an online form), ask in person or by phone, or ask on social media.
You do not need a form or particular words, you do not have to mention the law, and you do not have to send it to a particular person. It is enough that it is clear you are asking for your own information.
If you want particular information, say so. If your request is vague or they hold a lot about you, they can ask you to clarify, and the clock pauses while they wait for your answer.
A letter or email gives you a dated record of what you asked for and when.
Someone else, such as a relative, a friend or a solicitor, can make the request for you. It is up to them to show they have your authority.
Our letter: subject access request letter.

ID and clarifying your request

They can ask for ID if they need to be sure who you are. They should only ask for what is reasonable and proportionate, and only for formal ID if it is necessary.
If they ask for ID, the month starts when they get it. If someone made the request for you, it starts when they get proof of that person's authority.
They should only ask you to clarify your request if it is reasonably needed. The month pauses on the day they ask and starts again the day after they get your answer.
They cannot force you to narrow your request. If you repeat it, they must make a reasonable search.

Fees

In most cases they cannot charge a fee.
They can charge a reasonable fee for their admin costs only if the request is manifestly unfounded or excessive, or you ask for further copies. They should explain the costs, and the month starts when they get the fee.
If you do not reply to a request for a fee, it is generally reasonable for them to close your request after one month.

The deadline

They must reply without undue delay, and at the latest within one month.
The month starts on the day they get your request, whether or not it is a working day, and ends on the same date in the next month. For example, a request they got on 5 March is due by 5 April.
If the next month has no such date, the deadline is the last day of that month. For example, a request they got on 31 August is due by 30 September.
If the deadline falls on a weekend or bank holiday, they have until the next working day.
If the request is complex, or you have made several requests, they can take up to two more months: up to three months in all from the day they got it. They must tell you within the first month that they are taking longer, and why. If they did not, the one-month date stands.
Enter the date they got your request in the date box on the checker page. This site works out your exact dates; the AI does not.

What they can hold back

They must make a reasonable and proportionate search. They do not have to make searches that are unreasonable or out of proportion to the importance of the information.
They can refuse all or part of a request only if an exemption or restriction applies, and they must be able to justify it.
Information about other people: they do not have to give it unless that person agrees or it is reasonable to give it without their agreement.
Other exemptions that often come up include legal advice (legal professional privilege), confidential references, management information, negotiations with you, crime and taxation, and exam scripts and marks.
A manifestly unfounded or excessive request can be refused or charged for, but the bar for that is high.
If they refuse, they must tell you why, and tell you about your right to complain to them, to complain to the ICO and to go to court.

How you get the information

If you asked electronically, they must give it to you in a commonly used electronic format unless you ask for something else.
It must be clear and easy to understand, and they must take reasonable steps to send it securely.
They can give you secure online access instead, but you must be able to download a copy, and they must use another way if you cannot or do not want to use it.

Nobody can force you to make a request

It is a criminal offence for someone to make you use a subject access request to get records about you (for example of convictions, cautions or your health) so that they can see them, for example before giving you a job or an insurance contract.

If it is your employer

The same rules apply to your employer or a former employer. If you want particular emails, notes or records, say so.
Information about colleagues, legal advice and confidential references may be held back if an exemption applies.
Employment tribunal time limits do not wait for your subject access request. If you have a work claim, check its time limit now with the employment rights checker.

If they do not reply or you are unhappy

In most cases the ICO recommends that you complain to the organisation first and give it the chance to put things right.
From 19 June 2026 every organisation must give you a way to make a data protection complaint to it, acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome.
The 30 days start the day after they get your complaint. If the last day is a weekend or public holiday, they have until the next working day. Acknowledging your complaint is not the same as resolving it.
If you are still unhappy, you can complain to the ICO. The ICO cannot award compensation, even when it says an organisation has broken data protection law.
You can also go to court to make the organisation comply, to claim compensation for damage (including distress), or both. The organisation may agree to pay without a court claim. The ICO strongly recommends independent legal advice before any court claim.
This guide gives no time limit for complaining to the ICO or for a court claim: ask the ICO or an adviser.

Deadlines

Reply to your request: without undue delay, and within one month of them getting it (or the ID, proof of authority or fee they asked for).
Longer time: up to two more months (three in all), only if they told you within the first month, with reasons.
Clarifying your request: the month pauses from the day they ask until the day after they get your answer.
A request for a fee you do not answer: they can generally close your request after one month.
Your complaint to the organisation: acknowledged within 30 days.
This guide gives no time limit for complaining to the ICO or going to court.

Money figures

This guide gives no money amounts. A request is free in most cases; any fee must be reasonable and explained. Compensation is agreed with the organisation or decided by a court.

Where to go for help

Information Commissioner's Office (ICO): 0303 123 1113, Monday to Friday 9am to 5pm (not bank holidays), or live chat at ico.org.uk. It covers the whole UK.

Citizens Advice (England): 0800 144 8848

Citizens Advice (Wales): 0800 702 2020

Citizens Advice Scotland: 0800 028 1456

Advice NI: 0800 915 4604

Traps

The month runs from when they got your request, not when you sent it, and the day they got it counts.
Asking for ID, a fee or a clarification can make the deadline later. Reply quickly.
A longer deadline only counts if they told you within the first month, and why.
Information about other people may be blacked out or held back.
Complaining to the ICO does not get you compensation.
Keep a copy of your request and a note of the date they got it.

📜 Sources (checked 25 September 2026)

ico.org.uk: A guide to subject access (for organisations, last updated 16 July 2026, reflects the Data (Use and Access) Act 2025; checked 25 Sep 2026): requests verbal or in writing incl. social media; no set form of words, no need to cite legislation or a named contact; third party (relative, friend, solicitor) must evidence authority; children: competence, rules differ in different parts of the UK; comply without undue delay and within one month of receipt, or of receiving ID / proof of authority / a fee; extension up to a further two months if complex or a number of requests, must tell the person and why within one month; clarification only if reasonably required, clock pauses the day it is asked and resumes the day after the answer, cannot force a narrower request; no fee in most cases, reasonable fee if manifestly unfounded or excessive or further copies, explain costs, generally reasonable to close after one month without a reply; ID reasonable and proportionate, formal ID only if necessary, timescale starts on receipt; must make a reasonable and proportionate search; electronic request = commonly used electronic format; clear and accessible; security; remote access with download and an alternative; exemptions justified case by case (list incl. legal professional privilege, management information, negotiations with the requester, confidential references, exam scripts and marks, crime and taxation, information about other people); refusal must give reasons + right to complain to the controller, to the ICO and to the courts; third-party information only with consent or where reasonable; special cases (unstructured manual records, credit files, health, educational, social work); high threshold for manifestly unfounded or excessive; enforced SAR is a criminal offence.
UK GDPR Article 15(1)(a)-(h) (legislation.gov.uk, the Article the ICO guide cites): confirmation, copy, purposes, categories, recipients, retention period or criteria, rights to rectification / erasure / restriction / objection, right to complain to the Commissioner, source, automated decision-making incl. profiling (list as set out on the NI Policing Board SAR page, checked 25 Sep 2026).
Calculating the month (ICO right of access guidance, as quoted by RPC 21 Jan 2020, Ward Hadaway and A&L Goodbody 3 Sep 2019): starts on the day of receipt whether or not a working day, ends on the corresponding calendar date; no such date = last day of the following month (31 Aug -> 30 Sep); weekend or public holiday = next working day. Same rule as the ukwr-fields.js sar date box (sameDateMonths + nextWeekday, 3 months for the extension, bank holiday note in the box footer). RECHECK on the ICO detailed page before the deploy.
ico.org.uk: How to make a data protection complaint to an organisation (for the public, checked 25 Sep 2026): 30 days to acknowledge, starting the day after receipt; weekend or public holiday = next working day; acknowledging is not resolving; look into it, keep you updated; complaining for someone else needs authority.
ico.org.uk: How to deal with data protection complaints / Complaints guidance for organisations (DUAA 2025 inserts s164A into the DPA 2018): give people a way to complain, acknowledge within 30 days, respond without undue delay and keep people informed, tell them the outcome without undue delay. In force 19 June 2026: Gowling WLG and Michelmores 2026, digit.fyi (ICO statement), ICO Data Protection Review Guide (signed off 18 Jun 2026, applies from 19 Jun 2026).
ico.org.uk: Check if you can complain (make-a-complaint/data-protection-complaints): in most cases raise the concern with the organisation first; 0303 123 1113 or live chat. ico.org.uk/concerns: helpline Monday to Friday 9am to 5pm, excluding bank holidays. GOV.UK Data protection - make a complaint: ICO 0303 123 1113.
ico.org.uk: Taking your case to court and claiming compensation + Are there other routes I can take? (checked 25 Sep 2026): court to enforce your rights, claim compensation, or both; material and non-material damage (distress); the ICO cannot award compensation even when it gives an opinion that the law was broken; the organisation may agree to pay; strongly recommends independent legal advice.
Scotland line reused from dataprotection.html's Scotland rules (checked 20 September 2026, pre-flight guard P29): ICO for SARs incl. Scottish councils; Scottish Information Commissioner FOI to Scottish public bodies only; SPSO service complaints, not data protection.
Help lines reused from earlier guides: Citizens Advice England 0800 144 8848, Wales 0800 702 2020, Citizens Advice Scotland 0800 028 1456, Advice NI 0800 915 4604.

⚠ Important disclaimer: This guide covers the right of access to your own personal information (subject access requests) under the UK GDPR and the Data Protection Act 2018, for people in England, Wales, Scotland and Northern Ireland as at 25 September 2026. General legal information only, not legal advice. ukworkrights.co.uk — Not a law firm.

How Do I Make a Subject Access Request?

💬 Check your own situation

Who this guide is for

What this guide does not cover

⚖ At a glance

The questions that decide the answer

What you can ask for

How to make a request

ID and clarifying your request

Fees

The deadline

What they can hold back

How you get the information

Nobody can force you to make a request

If it is your employer

If they do not reply or you are unhappy

Deadlines

Money figures

Where to go for help

Traps

📜 Sources (checked 25 September 2026)

Comments

Found this helpful?

⚖ Important — Please Read Before Continuing

1. This is guidance — and only ever guidance

2. AI can make mistakes

3. Verified figures and guidance sources

4. What happens to what you type

5. Your responsibility

6. Useful Official Resources

7. Scope of this service

Report an Issue

Share Your Feedback

How Do I Make a Subject Access Request?

💬 Check your own situation

Who this guide is for

What this guide does not cover

⚖ At a glance

The questions that decide the answer

What you can ask for

How to make a request

ID and clarifying your request

Fees

The deadline

What they can hold back

How you get the information

Nobody can force you to make a request

If it is your employer

If they do not reply or you are unhappy

Deadlines

Money figures

Where to go for help

Traps

📜 Sources (checked 25 September 2026)

Comments

Found this helpful?

⚖ Free Account — UK Work Rights