Got a minute to help? take our quick website survey >
Asking for your personal data
Explains your right to request copies of personal data and records held about you by different organisations.
Personal data rights overview
Different organisations hold personal data about us. Our GP might hold our medical records (which we might call ‘medical notes’). Or our local council might hold our social services records.
Personal data relates to us in such a way that someone can identify us from it. We might also hear this called ‘personal records’ or ‘personal information’.
You or someone you care for might want to find out about, or ask for copies of, personal data. This page offers an overview of related laws and your rights.
Key facts about personal data rights
We've got a list of key facts about personal data and your rights to help you understand more:
- If you have a mental health problem, you might want to know what data an organisation keeps on file about you. This might include employers, doctors, hospitals, social services and the police.
- You usually have the right to ask organisations for copies of personal data they hold about you. Some organisations might call this ‘personal information’ or 'personal records'. Your right is protected by the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. Both of these are amended by the Data (Use and Access) Act 2025 (DUAA).
- When you ask for personal data from an organisation, you need to make a written or verbal request. You'll usually hear this called a subject access request (SAR).
- In some situations, organisations are allowed to withhold your personal data from you.
- Organisations have 1 calendar month to respond to your SAR. They're not usually allowed to charge a fee for providing your data.
- If an organisation refuses or ignores your request, you can write to them to remind them of their legal duty. If they still don't provide the data you've asked for, you can complain to them directly.
- Since June 2026, organisations have a legal duty to operate a formal data protection complaints procedure.
- If you're unhappy with the response to your direct complaint, you can complain to the Information Commissioner's Office (ICO).
Subject access request (SAR)
This is a written request to an organisation asking for details of the personal information they hold about you.
See our pages on accessing my personal information to find out more.
Visit our full listing of Legal TermsData (Use and Access) Act 2025 (DUAA)
The Data Use and Access Act 2025 (DUAA) is a law that came in to update data protection rules. This law makes the rules simpler for organisations, while still protecting your rights.
Visit our full listing of Legal TermsData Protection Act 2018
The Data Protection Act 2018 is the law that sets out how organisations must handle and process your information. It also gives you rights to access personal information held about you. And rights to correct personal information held about you if it's wrong.
Visit our full listing of Legal TermsGeneral Data Protection Regulation (UK GDPR)
These regulations tell organisations how they can use your personal information. They also give you rights to access and correct personal information held about you.
Visit our full listing of Legal TermsHealth record (or medical record)
A health record (or medical record) is any record of information relating to your physical or mental health that has been made by, or on behalf of, a health professional.
Visit our full listing of Legal TermsPublished: June 2026
Next review planned: June 2029
References are available on request. If you would like to reproduce any of this information, see our page on permissions and licensing.
