Asking for your personal data

Explains your right to request copies of personal data and records held about you by different organisations.

How to ask for your personal data

Different organisations might hold personal data and records about you. This might include information about your mental health. You have a legal right to ask about and request copies of personal data held about you.

While your personal data rights are protected by UK law, you might feel unsure about how to get your data. You're not alone, and our information is here to help you.

How do I ask for copies of my personal data?

To ask an organisation for copies of your data, you can make a verbal or written request. This is called a subject access request (SAR).

To submit an SAR to an organisation, you can:

• Send an email or a letter asking for copies of your records
• Do your request verbally, such as phoning them or visiting their offices in person
• Fill in and send a standard form provided by the organisation, which might be a Word document or PDF
• Fill in and send a non-standard form provided by the organisation, such as a form on their website

In any type of SAR, you should also specify the format in which you want your data.

What should I think about before preparing my SAR?

It might feel difficult to think about what you need to include in your SAR. We have some ideas to help you prepare your SAR in any type of format.

Before preparing your SAR, consider the following tips:

• Be specific about the data or records you want. For example, you might want to see your social services records over a certain period of time. Or you might want to read your medical records held by a particular doctor. If your request is too vague, the organisation might ask you to be more specific. This could cause a delay in getting the data you want.
• Don't ask for more data than you need. Although you could ask for ‘all personal data that the council holds about me’, you might end up with lots of information you don't need. It might be better to ask for records held by a particular service or department. For example, asking for ‘my social services records from 2010 to 2015’ or for ‘a copy of my personnel file’.
• Mention the laws that protect your rights. It's worth including that you're making your request under specific laws. Mention the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 and Data (Use and Access) Act 2025 (DUAA).

What should I do after preparing my SAR?

After preparing your SAR, there are some things to consider when submitting it. Once you've checked all the details, we suggest trying these practical tips depending on the format:

• Send a written request by email or recorded delivery. Doing this will give you proof of the date you sent the SAR. You should also keep a copy of your letter, email or form, and any other correspondence. This will be key evidence if you need to complain to the Information Commissioner's Office (ICO).
• Provide copies of proof of identity. The organisation will need to make sure that you are who you say you are. They might ask for a photocopy of your passport, driving licence or recent utility bill. If you provide proof when submitting your SAR, it might speed up the process. Or if the person from the organisation already knows you well, you might not need to show proof of identity.

How long will it take to get a response to my SAR?

Organisations have 1 calendar month to respond to your SAR. This time limit starts when they've received everything they need. Not when they've received just your initial SAR.

The other requirements might include:

• Proof of identity, like a photocopy of your passport or driving licence
• A utility bill to prove your address
• Payment of a fee, if your request is manifestly unfounded or excessive

An organisation can pause the 1-month response time limit if they need to:

• See your proof of identity or address
• Confirm details about the data you want, if it wasn't clear in your SAR

If an organisation finds your request very complicated, they can have an extension of up to 3 months total. This includes the initial 1-month response time limit. If they need the extension, the organisation:

• Must write to you explaining why they need this extension
• Should keep in touch with you during the 3-month period

How to do an SAR: step-by-step summary

1. Think about the personal data or records that you need to request copies of.
2. Identify which organisation holds this personal data.
3. Check their website or call them to find out:
   • Where to send the SAR
   • Whether they have a standard form or you can submit your own
   • If they need proof of identity or address along with the SAR
4. Draft your SAR letter, speak to them by phone or in person, or complete their form.
5. Send the SAR to the relevant contact with proof of identity, if needed. Ideally, send by email or recorded delivery so you have proof of when it was sent.
6. Keep your own dated copy of the letter or form.
7. Take note of the organisation's response deadline. The deadline will be 1 calendar month after the organisation confirms receipt of all requirements.

Published: June 2026

Next review planned: June 2029