Read our guidance
Before you make a complaint, read our guidance about making a SAR to check if the organisation has followed the law.
Sometimes you might be unhappy with the outcome of your request, but the organisation has done everything they have to do.
Complain to the organisation
You can resolve many problems directly with the organisation.
If it has been over one month since you made your request and you’ve not heard from the organisation, you should send them a follow up email or letter.
If you’ve already received a response to your SAR, but are unhappy for any reason, you should first complain to the organisation. We recommend that you do this by email, where possible.
If you think personal information is missing from the response, you should clearly list what other information you think they also have. This will help them review their records.
Remember to keep copies of any letters or emails about your complaint, or written records about any calls or meetings you’ve had, as evidence.
You could use the following complaint letter or email template as a guide, adding in the details of your own complaint:
[Your full address]
[Phone number]
[date]
[Name and address of the organisation]
[Reference number (if the organisation has given you one)]
Dear [Sir or Madam / name of the person you have been in contact with]
Subject access request complaint
[Your full name and address and any other details such as account number so they know who you are]
I’m concerned you haven’t done everything you’re meant to.
[Give details of your complaint clearly and simply and, if needed, its effect on you.
Examples of what you may wish to say are:
You haven’t sent me the following information:
[List clearly what other information you think they still have]
You’ve removed or blacked out information and you haven’t explained why.
[Give details of the email or document where they’ve removed or blacked out information.]
I understand that before reporting my complaint to the Information Commissioner’s Office (ICO) I should give you the chance to deal with it.
I’ll give a copy of your reply to the ICO if I decide I still want to report my complaint to them.
You can find guidance on what you’re meant to do if you receive a subject access request on the ICO’s website (www.ico.org.uk or https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/helping-you-find-subject-access-request-resources/). There’s also information on their regulatory powers and the action they can take.
Please respond fully within one calendar month. If you can’t reply within that time, please tell me when you will be able to reply.
If you’d like to discuss this, please contact me on [telephone number / email address].
Yours sincerely
[Signature]