Subject Access Request (General) Letter Template & Generator

If you need to request all personal data held about you by any organisation, a written letter is the recommended first step — it creates a clear record and shows you're pursuing the matter formally. Below is what a strong subject access request (general) should include, plus a free tool to generate yours.

What this letter needs to cover

• Reference Article 15 UK GDPR and the Data Protection Act 2018
• Request: all personal data held, the purposes for which it is processed, categories of data, recipients, retention period, source of data
• Note the organisation has one calendar month to respond
• State no fee should be charged

What a Subject Access Request actually gets you

A Subject Access Request (SAR) entitles you to a copy of all the personal data an organisation holds about you, along with information about why it's held, who it's shared with, and how long it will be kept. This applies to any organisation processing your data — employers, banks, healthcare providers, and more — and is one of the most powerful tools available under UK GDPR.

What to include before you send it

• A clear statement that you're making a Subject Access Request under UK GDPR
• Enough detail to help the organisation locate your data — full name, any reference numbers, and relevant dates
• Confirmation of the format you'd like the information provided in
• A note of the one-month statutory response deadline

What you're entitled to receive

This includes not just raw data, but the purposes of processing, categories of data held, who it's been shared with, how long it will be retained, and information about your other rights (like erasure or correction). If an organisation only provides a partial response, you can ask specifically what's missing and why.

Frequently Asked Questions

Is there a fee for a Subject Access Request?
No — SARs are generally free, though an organisation can charge a reasonable fee for excessive, repetitive, or manifestly unfounded requests.

What if the organisation ignores my request entirely?
You can complain to the Information Commissioner's Office, who can investigate and require compliance.

See our full letter template & generator library for related letters, or use our free checkers for guidance specific to your situation.