Subject Access Request UK: What You Can Ask For and When a SAR Can Be Refused

Overview

If you want to know what information a company, employer, landlord, bank, insurer, school, medical provider or public body holds about you, a SAR request UK process is often the starting point. It is not only about getting a printout of a file. A well-made request can help you understand what personal data exists, where it came from, who it was shared with, how long it is kept, and whether decisions about you were made in a structured or automated way.

In simple terms, a subject access request asks for your personal data. Personal data usually means information relating to you that can identify you directly or indirectly. That can include account notes, complaint logs, call recordings, emails about you, CCTV footage, chat transcripts, case management records, HR notes, internal comments that identify you, and correspondence linked to your name, address, account number or another identifier.

A SAR is not a general right to see every document an organisation holds. The right is narrower and more precise: access to your personal data and certain related information. That distinction matters because organisations sometimes reject requests as too broad, and requesters sometimes ask for categories of material that are outside scope. Knowing the difference makes your request stronger.

As a checklist, start here:

• Identify the organisation that controls the data.
• State clearly that you are making a subject access request.
• Give enough information to help them find your records.
• Be specific about time periods, departments, accounts or incidents if relevant.
• Ask for both the personal data and the standard supporting information about processing.
• Keep a copy of the request and proof of the date sent.
• Be ready to verify your identity if reasonably asked.

A basic SAR can be brief. A better one is focused. For example, if you are in a complaint with your bank, insurer or broadband provider, asking for “all personal data relating to my complaint from January to March, including call recordings, complaint notes, internal case logs and correspondence” is often more useful than asking for “everything you hold about me”. If your dispute is financial, you may also want to review related complaint routes such as How to Complain to Your Bank in the UK and Escalate to the Financial Ombudsman or How to Complain About an Insurance Claim in the UK.

People often use a subject access request template UK searches bring up online, and templates can help. But copying one blindly can produce a vague, overlong request. A good SAR is tailored to your situation. If you are dealing with a landlord, council housing team or letting agent, your request might focus on repair logs, inspection notes, complaint records, internal emails discussing your property, and any records of reported damp, mould or hazards. Related housing guides on complains.uk include How to Complain About Your Landlord in the UK and Council Housing Complaint Guide UK.

Checklist by scenario

This section gives you a practical SAR checklist by common use case so you can ask for the right material, not just more material.

1. You want to see what a company holds after a complaint

This is one of the most common reasons people ask, “what is a subject access request?” You may suspect that phone calls were logged inaccurately, that internal notes do not match what you were told, or that your complaint was mishandled.

• Ask for complaint records, call recordings, account notes, live chat logs and internal case history.
• Give dates, reference numbers and the staff team if known.
• Ask for records of any data shared with third parties.
• Ask for the source of any information used against you.
• Request copies in a commonly accessible electronic format where possible.

This can help in disputes about refund rights, billing, travel disruption or service failures. If your issue is really about the underlying consumer dispute, a SAR is evidence-gathering, not the full remedy. You may also need the relevant complaints route, for example Airline and Holiday Refund Rights UK or Broadband and Mobile Complaint Guide UK.

2. You need records from an employer or former employer

A SAR can be useful in workplace disputes, especially where you want to understand how a grievance, disciplinary issue, sickness absence or performance process was recorded. It can also help you see whether internal comments, meeting notes or email discussions mention you in a way that matters to your case.

• Ask for HR file data, grievance records, disciplinary records, meeting notes, email correspondence containing your name, and attendance or performance records.
• Narrow the timeframe to the relevant months if possible.
• Identify specific managers, HR staff or business units if relevant.
• Remember that not every internal document must be disclosed in full just because it mentions you; third-party rights and exemptions may apply.

If timing matters because you may bring a legal claim, check deadlines separately. A SAR does not pause limitation periods or tribunal deadlines. For broader timing issues, see UK Limitation Periods Guide.

3. You want housing records from a landlord, agent or council

In housing disputes, a gdpr access request UK process can uncover repair reports, contractor notes, inspection records, complaint logs, vulnerability flags, internal emails discussing your household, and records of visits or access attempts.

• Ask for repair history, inspection notes, photographs linked to your complaint, call logs and contractor communications that identify you.
• Specify the address and rough dates of reports.
• Ask for records of complaints, anti-social behaviour reports, tenancy management notes or safeguarding referrals if those are part of the dispute.
• Be realistic: data about neighbours may be redacted if disclosure would affect their rights.

If your dispute also concerns deposit deductions, a SAR may help but it is only one part of the evidence. See Tenancy Deposit Dispute UK for the separate scheme process.

4. You want CCTV, call recordings or bodycam footage

People often assume these items are automatically easy to obtain. In practice, they can be time-sensitive and technically awkward.

• Give the exact date, approximate time and location.
• Describe yourself so the organisation can identify the footage.
• Request related audio if there was sound recording.
• Act quickly because retention periods may be short.
• Expect redactions or edited copies if other people appear.

If the organisation says footage no longer exists, ask when it was deleted and what its retention policy is. That answer may matter later if you are assessing whether your complaint was handled properly.

5. You want to understand automated decisions or profiling

Sometimes the practical issue is not a single note or email but a decision process: fraud checks, account restrictions, insurance risk scores, platform moderation or eligibility screening.

• Ask for the personal data used in the decision.
• Ask for meaningful information about the logic involved, where relevant.
• Ask for the categories of data considered and the source of that data.
• Ask who received the result of the decision and whether human review took place.

This will not always produce a detailed algorithm disclosure, but it may give useful context about how your data was used.

6. You have been refused and want to assess whether the refusal is valid

SAR refusal UK issues often come down to one of a few points: the organisation says it cannot identify you, cannot locate the data without more detail, the request is manifestly unfounded or excessive, disclosure would affect others' rights, legal professional privilege applies, or another exemption is engaged.

• Read the refusal carefully. A bare rejection is not enough.
• Check whether they asked for ID or clarification first.
• Check whether they explained what part of the request was problematic.
• Offer to narrow the timeframe or categories if the request was very broad.
• Ask them to identify which exemption they rely on, in plain language.

A refusal can be lawful in some circumstances, but an organisation should still deal with the request properly. It should not simply ignore you because the request is inconvenient.

Simple SAR wording you can adapt

You do not need legal language. A practical formal complaint email example style works well:

Subject: Subject access request

Body: I am making a subject access request for personal data you hold about me. Please provide a copy of my personal data and the related information you are required to give about how it is processed. In particular, please include [list the records you want]. My details are [name, address, account or reference number, email, phone]. The relevant period is [dates]. Please send the response by email if possible. If you need further information to identify the data, please let me know promptly.

That is enough for many cases. Add detail only where it will help them find the material.

What to double-check

Before sending a SAR request UK readers often benefit from a short pre-flight check. It can prevent delay and reduce the chance of a brush-off.

Are you asking for personal data, not general disclosure?

A SAR is not a substitute for court disclosure, pre-action disclosure, or a demand for all internal records regardless of whether they are personal data. If you ask for “all documents relating to my complaint”, the organisation may push back. If you ask for “all personal data relating to my complaint, including internal notes, recordings and correspondence in which I am identified”, your request is more clearly tied to the legal right.

Have you identified yourself properly?

Use the details the organisation will recognise: full name, previous name if relevant, account number, customer reference, address history, tenancy dates, employee number, claim number or complaint reference. If you have changed email address, mention that too.

Is the request focused enough?

You do not always need to narrow it, but focus helps. If the dispute concerns a cancelled policy in February, a two-year request for all data held by the insurer may slow everything down. Narrow by date, team, property, transaction, account or incident where possible.

Do you need supporting information as well as the data itself?

Ask not only for copies of the data but also for the related information that helps make sense of it, such as purposes of processing, categories of data, recipients or recipient categories, retention periods, and the source of the data if it was not collected from you directly.

Have you considered third-party data and redactions?

If emails mention other customers, tenants, employees or neighbours, some information may be blanked out. That does not automatically make the response defective. The question is whether your personal data has been given to you as far as reasonably possible while protecting others' rights.

Are you tracking dates?

Keep your sent email, postal receipt or webform confirmation. If the organisation asks for ID or clarification, save that too. A timeline becomes important if you later complain about delay.

Do you need a different route as well?

A SAR can reveal information, but it does not directly order compensation, repairs, refunds or complaint outcomes. In many cases you may need a parallel complaint route, ombudsman route or court route. If your dispute later becomes a money claim, the practical court process is different; see Small Claims Court Fees UK for a general overview of the small claims framework.

Common mistakes

The biggest problems with subject access requests are usually practical, not legal. These are the mistakes that most often weaken a request or make the response less useful.

• Sending a vague demand for “everything”. Broad requests can still be valid, but they are harder to process and easier for organisations to challenge as unclear or excessive.
• Using hostile language at the start. A firm, calm request is usually more effective than a threatening email full of accusations.
• Forgetting to include identifiers. Without an account number, address, claim reference or employment details, the organisation may struggle to locate your data.
• Assuming a SAR forces disclosure of every internal document. It does not. The right is to your personal data, not unlimited inspection of the file.
• Ignoring a request for ID or clarification. If the organisation reasonably asks for more information and you do not reply, the process may stall.
• Not checking attachments carefully. Responses often arrive in batches or through secure portals. Important items can be easy to miss.
• Missing the bigger complaint route. A SAR is often evidence for another process, not the end of the dispute itself.
• Waiting too long for short-lived evidence. CCTV, recordings and some logs may not be kept long.
• Assuming refusal means the matter ends there. Some refusals are lawful, but some are poorly explained, overbroad or based on a request that could be narrowed and resubmitted.

If the response looks thin, compare it against what you know exists. Were there calls, complaint references, inspections, meetings, emails, letters or portal messages that are missing? A polite follow-up listing the gaps is often more effective than immediately escalating.

If you are considering a complaint to the data protection regulator, prepare a short evidence pack: your original request, any ID provided, the response timeline, the refusal or partial disclosure, and a concise explanation of what is missing and why you think it is personal data. Keeping the issue organised matters more than writing at length.

When to revisit

This is a topic worth revisiting whenever the facts change. A SAR is rarely a one-off document exercise. It becomes useful at particular stages of a dispute, complaint or legal problem.

• Revisit before escalating a complaint. If the organisation's final response does not match its records, a SAR may help you test that.
• Revisit when new incidents occur. A later repair report, account restriction or HR meeting may justify a fresh, narrower request.
• Revisit before limitation or tribunal deadlines. A SAR can help gather information, but do not wait for it if you have a separate deadline running.
• Revisit when systems or providers change. Mergers, new portals, outsourced services or account migrations can affect where data sits and how you should describe it.
• Revisit seasonally if your issue involves short retention data. Footage, call recordings and temporary logs can disappear quickly, so act promptly after the event.

A practical end-of-article action plan is simple:

1. List the exact issue you are trying to prove or understand.
2. Write down the organisation, reference numbers and key dates.
3. Decide what personal data is most likely to matter.
4. Send a focused subject access request.
5. Diary the expected response date and keep all correspondence.
6. On receipt, compare the response against your own timeline.
7. If needed, follow up with a short gap list or escalate through the organisation's complaint process and then the appropriate regulator or ombudsman route.

If you use that checklist, a SAR becomes less of a legal mystery and more of a practical tool. The goal is not to ask for the biggest possible bundle of documents. It is to obtain the personal data that helps you understand what happened, challenge inaccuracies, and make better decisions about your next step.