- a clear label for your request (eg use ‘subject access request’ as your email subject line or a heading for your letter);
- the date of your request;
- your name (including any aliases, if relevant);
- any other information used by the organisation to identify or distinguish you from other individuals (eg customer account number or employee number);
- your up-to-date contact details;
- a comprehensive list of what personal data you want to access, based on what you need;
- any details, relevant dates, or search criteria that will help the organisation identify what you want; and
- how you would like to receive the information (eg by email or printed out).
- other information with your request, such as details about a wider customer service complaint;
- a request for all the information the organisation holds on you, unless that is what you want (if an organisation holds a lot of information about you, it could take them longer to respond, or make it more difficult for you to locate the specific information you need in their response); or
- threatening or offensive language.
Where possible, send your request directly to the individual or team who deal with subject access requests, such as the data protection officer.
You could use our subject access request letter template as a guide, adding exactly what information you are asking for:
[Name and address of the organisation]
[Your name and full postal address]
[Your contact number]
[Your email address]
Dear Sir or Madam
Subject access request
[Include your full name and other relevant details to help identify you].
Please supply the personal data you hold about me, which I am entitled to receive under data protection law, held in:
[Give specific details of where to search for the personal data you want, for example:
- my personnel file;
- emails between ‘person A’ and ‘person B’ (from 1 June 2017 to 1 Sept 2017)
- my medical records (between 2014 and 2017) held by ‘Dr C’ at ‘hospital D’;
- the CCTV camera situated at (‘location E’) on 23 May 2017 between 11am and 5pm; and
- financial statements (between 2013 and 2017) held in account number xxxxx.]
If you need any more information, please let me know as soon as possible.
[If relevant, state whether you would prefer to receive the data in a particular electronic format, or printed out].
It may be helpful for you to know that data protection law requires you to respond to a request for personal data within one calendar month.
If you do not normally deal with these requests, please pass this letter to your data protection officer or relevant staff member.
If you need advice on dealing with this request, the Information Commissioner’s Office can assist you. Its website is ico.org.uk, or it can be contacted on 0303 123 1113.
Can I make a subject access request verbally?
Yes. You can make a subject access request verbally, but we recommend you put it in writing if possible because this gives you a record of your request.
If you are making a verbal request, try to:
- use straightforward, polite language;
- focus the conversation on your subject access request;
- discuss the reason for your request, if this is appropriate – work with them to identify the type of information you need and where it can be found;
- ask them to make written notes – especially if you are asking for very specific information; and
- check their understanding – ask them to briefly summarise your request and inform them if anything is incorrect or missing before finishing the conversation.
However, even if you make your request verbally, we recommend you follow it up in writing (eg by letter, email or using a standard form).
Should I use an organisation’s standard form?
Standard forms are not compulsory and are not always provided. However, an organisation may ask you to use theirs.
Standard forms can make it easier for an organisation to deal with your subject access request. They can:
- structure your request;
- prompt you to include necessary details and supporting documents; and
- let you know the best contact point at the organisation.
However, you can still choose another method to submit your request.
Can someone else make a request on my behalf?
Yes, you can authorise someone else to make a subject access request for you. However, you should consider whether you want the other person to have access to some or all of your personal information.
Depending on the nature of your request, the other person could gain access to information that you may not want to share with them, such as your medical history.
Examples of individuals making requests for other people include:
- someone with parental responsibility, or guardianship, asking for information about a child or young person (for further information, please read our guidance for organisations on requests for information about children);
- a person appointed by a court to manage someone else’s affairs;
- a solicitor acting on their client’s instructions; or
- a relative or friend that the individual feels comfortable asking for help.
An organisation receiving the request needs to be satisfied that the other individual is allowed to represent you.
They may ask for formal supporting evidence to show this, such as:
- written authorisation from you; or
- a more general power of attorney.
It is the other person’s responsibility to provide this when asked to do so.
Should I keep a record of my request?
Yes – whenever possible, we strongly recommend that:
- you keep a copy of any documents or written correspondence for your own records;
- you keep any proof of postage or delivery (such as a postal reference number), if available; and
- if using an online submission form, you take a screenshot before sending.
Where relevant documents are not available for you to copy, consider making a written log of your request. This should include key details, such as:
- the date and time of your request;
- the location (eg if your request was made in person);
- the contact number or submission form you used;
- the details of any contacts you have interacted with;
- notes about any personal information you asked for;
- any further information that the organisation may have asked you to provide;
- any reference numbers given to you; and
- any other relevant information.
This will provide helpful evidence if you wish to:
- follow up your request;
- raise concerns; or
- complain about an organisation’s response, at a later stage.