Subject Access Request (General) Letter: Free Template and What to Include

If you need to request all personal data held about you by any organisation, a written letter is the recommended first step — it creates a clear record and shows you're pursuing the matter formally. Below is what a strong subject access request (general) should include.

What this letter needs to cover

• Reference Article 15 UK GDPR and the Data Protection Act 2018
• Request: all personal data held, the purposes for which it is processed, categories of data, recipients, retention period, source of data
• Note the organisation has one calendar month to respond
• State no fee should be charged

What a Subject Access Request actually gets you

A Subject Access Request (SAR) entitles you to a copy of all the personal data an organisation holds about you, along with information about why it's held, who it's shared with, and how long it will be kept. This applies to any organisation processing your data — employers, banks, healthcare providers, and more — and is one of the most powerful tools available under UK GDPR.

What to include before you send it

• A clear statement that you're making a Subject Access Request under UK GDPR
• Enough detail to help the organisation locate your data — full name, any reference numbers, and relevant dates
• Confirmation of the format you'd like the information provided in
• A note of the one-month statutory response deadline

What you're entitled to receive

This includes not just raw data, but the purposes of processing, categories of data held, who it's been shared with, how long it will be retained, and information about your other rights (like erasure or correction). If an organisation only provides a partial response, you can ask specifically what's missing and why.

Frequently Asked Questions

Is there a fee for a Subject Access Request?
No — SARs are generally free, though an organisation can charge a reasonable fee for excessive, repetitive, or manifestly unfounded requests.

What if the organisation ignores my request entirely?
You can complain to the Information Commissioner's Office, who can investigate and require compliance.

[Your Name]
[Your Address]
[Your Postcode]
[Your Email Address]
[Your Phone Number]
[Name of Organisation]
[Address Line 1]
[Address Line 2]
[Postcode]
[Date]

Dear [Name of Contact or "Data Protection Officer"],

Subject: Subject Access Request (SAR)

I am writing to make a Subject Access Request for my personal data held by your organisation.

Under Article 15 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, I am entitled to a copy of the personal data you process about me.

To help you find my records, my details are:
• Full Name: [Your Name]
• Date of Birth: [Your Date of Birth]
• Account or Reference Number: [customer or employee reference number]

I would like copies of [choose one: all personal data you hold about me / specific records, for example emails between me and your staff about my complaint between January 2026 and March 2026].

Please also tell me:
• why you are processing my data
• the types of personal data you hold
• who you have shared it with
• how long you will keep it
• where you got it from, if not from me

Please send this to me securely by email to the address above, or by post if you cannot send it electronically. I understand there should be no fee for this request.

You must respond without undue delay and within one calendar month of receiving this request. If you need anything more to confirm my identity, please contact me straight away.

Yours sincerely,

[Your Signature]
[Your Printed Name]