Subject Access Requests (SAR)
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
If you’re running a small business, group or charity, you’ve probably got information about people stored as contacts on your phone or computer, or in notes or other documents.
By law, people can ask you for a copy of any information that’s to do with them. It might be saved on your system, but if it’s about them, it’s their personal data, and they have a right to see it. If they ask you for a copy of it, by phone, in person, or in writing, they have made a ‘subject access request’ (SAR), and you need to take action.