Profile information Account settings
Sign up Log in

MAKE YOUR FREE Data subject access request (DSAR)

  • Make your document in minutes
  • Access from any device
  • Securely sign online
Make document

How to make a Data subject access request (DSAR)

Under section 45 of the Data Protection Act 2018, you can make data subject access requests (also known as 'DSARs' and 'SARs') to businesses and other organisations that hold your personal data. Use this document to make a written SAR to a business.

Use this data subject access request:

  • to request access to your personal data held by a business

  • if you are based in England, Wales or Scotland

  • if the business is based in England, Wales or Scotland

This data subject access request covers:

  • your details

  • the business’ details

  • details of your rights relating to personal data

  • where the personal data you are requesting access to is held (eg in employment records, billing records or a user activity log)

  • how the personal data should be provided

A subject access request is a written request to a business or organisation asking for access to the personal information it holds on you. You can make SARs to find out a variety of things, including:

  • details of the personal data that is being processed (ie a copy of the data)

  • the reasons why this data is being processed

  • how this data was sourced (if available)

  • which other organisations or individuals have access to your data

Your SAR should, as a minimum, include: 

  • your full name (including any previous names, were relevant)

  • your up-to-date contact details (eg address and telephone number)

  • details of the specific information you require and any relevant dates

  • how you would like to receive the information (eg by email or in print)

A SAR should not include information not relevant to your request (eg a wider customer service complaint).

While you may request all the information an organisation holds on you, bear in mind that organisations may hold a lot of information and it could take them longer to respond or make it more difficult for you to locate the specific information you need in their response.

For more information, read Making subject access requests.

Businesses generally have one month to respond to your request. They may, however, need extra time to consider your request in some circumstances (eg if you have made several requests or where proof of ID is required). Where this is the case, they can take up to an extra two months to respond, informing you within one month if they need more time and explaining why.

For more information, read Data protection requests.

A business will generally tell you whether or not they process your personal information and, if they do, provide copies of it. They should also set out other details, including:

  • what they use your information for for

  • who they share your information with

  • how long they’ll store your information for and how this was decided

  • where they obtained your information from

  • if they use your information for profiling or automated decision-making and, if so, how this is done

Bear in mind that you may not always receive all the information you have requested.

For more information, read Making subject access requests and Data protection requests.

If a business doesn’t respond or you are dissatisfied with their response, you should contact the organisation. If you do not receive a response or remain dissatisfied with the response, you can complain to the ICO. For more information, read Data protection requests.

Ask a lawyer for:

  • if you are making a subject access request on behalf of someone else

  • if this document does not cover your legal needs

  • if the business is based outside of England, Wales or Scotland

  • if a business does not respond to your request

This DSAR is governed by the laws of England, Wales and Scotland.

Other names for Data subject access request (DSAR)

DSAR, Subject access request, SAR, Data protection request.