Get help now Make a donation

Accessing my personal information

Explains your rights to see and have copies of your personal information, and how to complain if access to your records is refused or if what is written about you is wrong.

  • This information applies to England and Wales.
  • This information applies to adults. It doesn't apply to children unless specifically stated.
  • In 2025 the government passed new laws making changes to the Mental Health Act. The changes will come in stages. For now, your rights under the Mental Health Act have not changed. We'll update our information when changes happen.

How to access your personal records

This page covers the following information about accessing your personal records:

Under 18?

We have info on your confidentiality rights.

Get info for young people

How do I get copies of my records?

To get copies of your records from an organisation, you almost always need to make a request in writing. This is called a subject access request (SAR).

A subject access request can be:

  • an email or a letter requesting copies of your records
  • spoken, such as over the phone or by asking in person
  • a standard form that an organisation may have for requesting access to records
  • a non-standard form, such as through an organisation’s website or social media account – for example Facebook or Twitter.

There may be practical difficulties in relation to you being able to prove your identity if you make a spoken request, or through a non-standard form.

This may lead to a delay in your request being dealt with.

For non-standard forms in particular, it's unlikely that the team responsible for social media will be responsible for dealing with subject access requests. This means they may not recognise your request as a subject access request.

How do I prepare my request?

When preparing your subject access request, make sure to:

  • Think about exactly what you want to see. For example your social services records for a particular period of time, or medical records held by a particular doctor.
  • Be specific about the records you want. If your request is too vague, the organisation might ask you to be more specific. This could cause a delay in getting the information you want.
  • Don't ask for more information than you need.  Although you can ask for 'all information that the Council holds about me', you may end up with information that's irrelevant. It might be better to ask for all records held by a particular service or department – for example 'all of my social services records' or 'a copy of my personnel file'. It's a good idea to mention that you’re making a subject access request under the Data Protection Act 2018.

After preparing your subject access request, you could:

  • Send your request by recorded delivery or email. This will mean that you have proof of the date your request was sent. You should also keep a copy of your letter or request form, and any other relevant correspondence. This will be important evidence if you need to make a complaint.
  • Give proof of identity. The organisation needs to make sure that you are who you say you are. You might be asked for a photocopy of your passport, driving license or a utility bill. But if the person you ask already knows you well, you shouldn't need to give detailed proof.

Under equality law, organisations have a legal duty to make their services accessible. Your mental health problem might make it impossible, or unreasonably difficult, for you to make a request in writing. In this case, an organisation may have to make a reasonable adjustment to its normal data protection policy.

Subject access request – letter template

If you're planning to make your request by letter or email, you can download this letter template to help you put it in writing:

Download SAR template letter (Word doc - opens in new window)

How long will it take to get a response?

Organisations have one calendar month to respond to your subject access request, starting from the day they receive it.

If the organisation thinks that your request is very complicated, then it can extend this period to three months. In this case, they must write to you to explain why the extension is necessary.

The organisation can pause the one-month response period if they need to:

  • see your proof of identity
  • confirm details about the information you want, if it is not clear.

Will I have to pay to get my information?

Organisations are not allowed to charge a fee for supplying your data unless your request is manifestly unfounded or excessive.

If an organisation decides it is appropriate to charge you for an excessive request, the amount must be based on how much it will cost them to fulfil your request.

Subject access requests: quick checklist

  1. Think about the personal information you wish to see.
  2. Identify which organisation holds this.
  3. Check their website or call them to find out who to send the subject access request to, whether the organisation has a standard form, and what proof of identification the organisation needs.
  4. Draft your subject access request letter or complete the form, if the organisation has one.
  5. Send to the relevant contact at the organisation with proof of identification. Ideally, send the request by recorded delivery or email so that you can keep track of it.
  6. Keep a dated copy of the letter or subject access request form you have sent.
  7. Put the deadline for them to get back to you in your diary – this will be one calendar month after receipt by the organisation.

Tip: If you can send appropriate proof of identity at the same time as making your request, it should make the process quicker.

Example scenario

Audrey experiences severe anxiety and depression. She also has a diagnosis of rheumatoid arthritis.

For some years now, Audrey has received support from social services with daily living tasks, including bathing, managing her money and getting out and about in the community.

Her package of care has recently been cut by social services. Audrey has an advocate who is going to help her make a complaint.

The advocate has suggested that it would be a good idea for Audrey to get copies of her social services records. Audrey has received support from social services for the past 15 years, so her records are likely to be extensive.

The decision to cut her care package was made six weeks ago. Audrey will need to see the records that relate to this decision. As well as this, there will probably be relevant records from before the date of the decision. However, she is unlikely to need copies of her social services records in their entirety.

Audrey could make a request for copies of her social service records from the past six months. She may not need to show proof of identity if she makes the request to her social worker, as her social worker knows her well.

< Your personal data rights What to do if your data request is unsuccessful >

This information was published in November 2021. 

This page is currently under review. All content was accurate when published. 

References are available on request. If you would like to reproduce any of this information, see our page on permissions and licensing.

arrow_upwardBack to Top