Subject Access Request (DSAR): How to Make One, Deadlines

TL;DR: A subject access request (SAR or DSAR) is your legal right under UK and EU GDPR to ask any organisation what personal data it holds about you and get a copy. You can ask verbally or in writing, it's usually free, and the organisation normally has one month to reply, extendable by two more months for complex requests. If they ignore you, complain to them first, then to the ICO (UK) or your national data protection authority.

👉 Free check covers your email in 30 seconds — full scan adds your phone number →

What you're entitled to

The ICO explains that you can ask an organisation whether it holds or uses your personal information, and request copies. A SAR can also reveal how your data is used, who it's shared with and where it came from. That last part is useful when a company you've never dealt with is contacting you.

How to make a request

Find the right contact. Look for a privacy or data protection email in the privacy policy. You don't have to use a form; any staff member can receive a request.
Say it's a subject access request. Name the right clearly so it isn't treated as a general query.
Help them find you. Include your name, contact details and any account, customer, employee or NHS number.
Be specific if you can. For example, “all call recordings and emails about my account from 2024.”
Keep a copy and the date sent. The clock usually starts when they receive it.

Our GDPR rights explainer covers the other rights you can use once you see the data, such as correction and erasure.

Deadlines, fees and ID

From the ICO's guide on what to expect after making a SAR:

One month is the normal deadline. The clock doesn't start until they have any ID they reasonably need, and can pause if they need you to clarify.
Up to two more months for complex requests or several requests, but they must tell you within the first month and explain why.
Usually free. A reasonable fee is allowed only if the request is manifestly unfounded or excessive, or for extra copies.
ID checks are more likely for sensitive information or if your details don't match their records.

The ICO notes its guidance is under review following the Data (Use and Access) Act, so check the latest version if your case is borderline.

If they ignore you or refuse

Send a reminder citing your original request date.
Use the organisation's complaints process.
Complain to the ICO at ico.org.uk/make-a-complaint. In the EU, go to your national data protection authority.

Good reasons to make a SAR

A company keeps calling or emailing and you want to know where it got your details. Pair it with the Telephone Preference Service.
You were caught up in a breach, such as the M&S and Co-op attacks, and want to know exactly what they held.
A people-search site lists you; see our UK, Canada and Australia opt-out guide.

In the US, state laws offer similar access rights; see US state privacy laws. And to see which companies leaked your email in the first place, run a free email exposure check.

Frequently Asked Questions

What is a subject access request?

Your right under UK and EU GDPR to ask an organisation whether it holds personal data about you and to get a copy, plus details of how it is used and shared.

How long does a company have to answer a SAR?

Normally one month. It can extend by up to two more months for complex or multiple requests, but must tell you within the first month.

Is a subject access request free?

Usually yes. A reasonable fee is allowed only for manifestly unfounded or excessive requests, or for further copies.

Does a SAR have to be in writing?

No. The ICO says you can ask verbally or in writing, though writing gives you a record of the date.

What if an organisation ignores my SAR?

Remind them, use their complaints process, then complain to the ICO in the UK or your national data protection authority in the EU.

How to Make a Subject Access Request (DSAR): Deadlines, Fees and What to Do If Ignored