How to make a subject access request?
The easiest way to make a subject access request is using our online service. It takes about 10 minutes. It helps you write your request then sends it to the organisation by email.
Preparing and submitting your subject access request
We want to safeguard and empower people by helping them to understand how their information is used and accessed. In ICO25, our strategic plan, we made a commitment to develop an online tool that supports people to make subject access requests in a way that enables businesses and organisations to respond effectively.
The first version of this tool is now ready to test and replaces the template letter that was previously available on this page.
The subject access tool will help you to identify where to send your request and explains what you should expect. It will send your request direct to the receiving organisation with instructions to help them respond to you quickly and simply.
This is the first version of the subject access tool and we are interested to hear what you think. Once you have submitted your request you will be able to share your feedback, which will help us refine the tool and make improvements.
What should my request say?
Do include:
- a clear label for your request (eg use ‘subject access request’ as your email subject line or a heading for your letter);
- the date of your request;
- your name (including any aliases, if relevant);
- any other information used by the organisation to identify or distinguish you from other individuals (eg customer account number or employee number);
- your up-to-date contact details;
- a comprehensive list of what personal data you want to access, based on what you need;
- any details, relevant dates, or search criteria that will help the organisation identify what you want; and
- how you would like to receive the information (eg by email or printed out).
Don’t include:
- other information with your request, such as details about a wider customer service complaint;
- a request for all the information the organisation holds on you, unless that is what you want (if an organisation holds a lot of information about you, it could take them longer to respond, or make it more difficult for you to locate the specific information you need in their response); or
- threatening or offensive language.
Where possible, send your request directly to the individual or team who deal with subject access requests, such as the data protection officer.
Frequently asked questions
Can I make a subject access request verbally?
Yes. You can make a subject access request verbally, but we recommend you put it in writing if possible because this gives you a record of your request.
If you are making a verbal request, try to:
- use straightforward, polite language;
- focus the conversation on your subject access request;
- discuss the reason for your request, if this is appropriate – work with them to identify the type of information you need and where it can be found;
- ask them to make written notes – especially if you are asking for very specific information; and
- check their understanding – ask them to briefly summarise your request and inform them if anything is incorrect or missing before finishing the conversation.
However, even if you make your request verbally, we recommend you follow it up in writing (eg by letter, email or using a standard form).
Should I use an organisation’s standard form?
Standard forms are not compulsory and are not always provided. However, an organisation may ask you to use theirs.
Standard forms can make it easier for an organisation to deal with your subject access request. They can:
- structure your request;
- prompt you to include necessary details and supporting documents; and
- let you know the best contact point at the organisation.
However, you can still choose another method to submit your request.
Can someone else make a request on my behalf?
Yes, you can authorise someone else to make a subject access request for you. However, you should consider whether you want the other person to have access to some or all of your personal information.
Depending on the nature of your request, the other person could gain access to information that you may not want to share with them, such as your medical history.
Examples of individuals making requests for other people include:
- someone with parental responsibility, or guardianship, asking for information about a child or young person (for further information, please read our guidance for organisations on requests for information about children);
- a person appointed by a court to manage someone else’s affairs;
- a solicitor acting on their client’s instructions; or
- a relative or friend that the individual feels comfortable asking for help.
An organisation receiving the request needs to be satisfied that the other individual is allowed to represent you.
They may ask for formal supporting evidence to show this, such as:
- written authorisation from you; or
- a more general power of attorney.
It is the other person’s responsibility to provide this when asked to do so.
Should I keep a record of my request?
Yes – whenever possible, we strongly recommend that:
- you keep a copy of any documents or written correspondence for your own records;
- you keep any proof of postage or delivery (such as a postal reference number), if available; and
- if using an online submission form, you take a screenshot before sending.
Where relevant documents are not available for you to copy, consider making a written log of your request. This should include key details, such as:
- the date and time of your request;
- the location (eg if your request was made in person);
- the contact number or submission form you used;
- the details of any contacts you have interacted with;
- notes about any personal information you asked for;
- any further information that the organisation may have asked you to provide;
- any reference numbers given to you; and
- any other relevant information.
This will provide helpful evidence if you wish to:
- follow up your request;
- raise complaints; or
- complain about an organisation’s response, at a later stage.