Find out what data an organisation holds
Last checked: 12 Oct 2026
A subject access request (SAR) asks an organisation for a copy of the personal data it holds about you. It's a good first step with a marketing-data company: it shows what they have and where it came from, before you object or ask for deletion.
How to make one
- Use any channel: the organisation's own SAR form or portal, email, post, phone or in person. Many organisations have an online form.
- Head it "subject access request" and include your name, contact details, anything that helps identify you (such as an account or customer number), what information you want, and the format you'd like it in.
- Or use the regulator's free SAR service, which creates an email request for you to send to the organisation. The reply comes to you, not the regulator.
What to expect
- Time limit: usually one month. It can be extended by up to two more months if the request is complex or you've made several, and the organisation must tell you within the first month.
- Cost: normally free. A fee is only possible for manifestly unfounded or excessive requests, or extra copies.
- Identity checks: the regulator says organisations should only ask for ID when they need it, for example for sensitive data or if they don't recognise your details.
- Refusals: an organisation can refuse all or part of a request that's manifestly unfounded or excessive, and can leave out other people's data or legally privileged material.
2025 changes now in force. The Data (Use and Access) Act 2025 changed two things. The regulator's SAR guidance is marked as under review and doesn't yet describe them:
- "Stop the clock" (from 5 February 2026): the month runs from the latest of receiving your request, confirming your identity, or receiving any fee, and pauses while the organisation reasonably asks you to clarify what you want.
- Reasonable and proportionate searches (treated as in force from 1 January 2024): you're entitled to what the organisation can provide from a reasonable and proportionate search.
If you don't get a response, or you're unhappy with it, see complaining about how your data is handled.
Sources
- Information Commission (ICO website): Getting copies of your information (SAR)
- Information Commission: What to expect after making a SAR
- Information Commission: Why organisations might refuse a SAR
- Information Commission: Make a subject access request (SAR service)
- Data (Use and Access) Act 2025, s.76 (time limits, "stop the clock")
- Data (Use and Access) Act 2025, s.78 (reasonable and proportionate searches)
This page describes your options and how organisations say they handle requests. It isn't legal advice. See About & sourcing to report a correction.