How to make a subject access request?
The easiest way to make a subject access request is using our online service. It takes about 10 minutes. It helps you write your request then sends it to the organisation by email.
The easiest way to make a subject access request is using our online service. It takes about 10 minutes. It helps you write your request then sends it to the organisation by email.
We want to safeguard and empower people by helping them to understand how their information is used and accessed. In ICO25, our strategic plan, we made a commitment to develop an online tool that supports people to make subject access requests in a way that enables businesses and organisations to respond effectively.
The first version of this tool is now ready to test and replaces the template letter that was previously available on this page.
The subject access tool will help you to identify where to send your request and explains what you should expect. It will send your request direct to the receiving organisation with instructions to help them respond to you quickly and simply.
This is the first version of the subject access tool and we are interested to hear what you think. Once you have submitted your request you will be able to share your feedback, which will help us refine the tool and make improvements.
Do include:
Don’t include:
Where possible, send your request directly to the individual or team who deal with subject access requests, such as the data protection officer.
Can I make a subject access request verbally?
Yes. You can make a subject access request verbally, but we recommend you put it in writing if possible because this gives you a record of your request.
If you are making a verbal request, try to:
However, even if you make your request verbally, we recommend you follow it up in writing (eg by letter, email or using a standard form).
Should I use an organisation’s standard form?
Standard forms are not compulsory and are not always provided. However, an organisation may ask you to use theirs.
Standard forms can make it easier for an organisation to deal with your subject access request. They can:
However, you can still choose another method to submit your request.
Can someone else make a request on my behalf?
Yes, you can authorise someone else to make a subject access request for you. However, you should consider whether you want the other person to have access to some or all of your personal information.
Depending on the nature of your request, the other person could gain access to information that you may not want to share with them, such as your medical history.
Examples of individuals making requests for other people include:
An organisation receiving the request needs to be satisfied that the other individual is allowed to represent you.
They may ask for formal supporting evidence to show this, such as:
It is the other person’s responsibility to provide this when asked to do so.
Should I keep a record of my request?
Yes – whenever possible, we strongly recommend that:
Where relevant documents are not available for you to copy, consider making a written log of your request. This should include key details, such as:
This will provide helpful evidence if you wish to: