What to expect after making a subject access request

What actions should I take after making a request?

Keep a record of your request

We recommend:

• keeping a copy of any emails or letters;
• keeping any proof of postage or delivery, eg a postal reference number; or
• taking a screenshot before sending your request (if you used an online form or portal). 

If you don’t have this information (eg if you made the request over the phone or in person), write down the information about what you asked for and when. It’s helpful if you include (where applicable):

• the date and time you asked for the information;
• where you were, eg a branch of a bank;
• the number you called or a link to the online form you used;
• the number you called from, eg your mobile, home number or work number;
• the name of the staff member you spoke to;
• the information you asked for;
• any reference numbers given to you by the organisation; and
• any other relevant information.

Provide proof identification (if asked)

ID checks are sometimes needed to check you are the person asking for the information and to protect your personal information. When asked for ID, you should provide it.

Provide more information (if asked)

Organisations might ask you for more information about what it is you’re requesting. Three common reasons for this are:

1. They have lots of information about you and want to narrow down the search.
2. They will struggle to respond to the SAR without it, eg they don't understand what you are asking for. 
3. You have made a similar SAR in the past and the organisation wants to know if you want the same information or new information.

If the organisation contacts you to ask for more information, they can stop dealing with your request until you reply (eg by email, letter or phone). You don’t need to give them the information they ask for, but it may help the organisation find the information you want. However, you must reply to them, even if it is just to say you aren’t giving them what they have asked for. We recommend you work with the organisation to help them understand your SAR where possible, as this will help you get what you need.

How long does the organisation have to reply to me?

Organisations normally have one month to reply to your request. If your request is unclear, an organisation may stop the clock until you explain what information you are looking for.

However, if they ask you for ID, the clock only starts when they have what they need from you.

If you’ve made a number of requests or your request is complex, the organisation may need extra time to consider it. They can take up to an extra two months to respond. If they are going to do this, they must let you know within one month of getting your request, and explain why they are taking longer.

The extra two months don’t apply when you’re asking for information collected or used for law enforcement reasons. This covers most information collected by the police. 

If an organisation chooses to charge a fee, the one-month time limit doesn’t begin until you have paid the fee.

See our detailed guidance on time limits for more details.

How much does a subject access request cost?

Normally, organisations can't charge for responding to your SAR. An organisation can charge a reasonable fee to cover their administrative costs if they think your request is ‘manifestly unfounded or excessive’.

They can also charge a fee if you ask for further copies of your information following a request. Intelligence services can always charge £10 for a SAR, if they choose to.