How to make a subject access request for your case 

What a SAR is

The Information Commissioner's Office (ICO) explains that you have the right to ask an organisation whether it is using or storing your personal information and to ask for copies of it. This is called the right of access, and is also known as a subject access request, SAR or DSAR. The ICO notes that its guidance is under review following changes made by the Data (Use and Access) Act, so check the ICO website for the latest version before you rely on the details.

What to put in the request

The ICO suggests including:

• A subject line saying "subject access request" and the date
• Your name, contact details and any other names, plus any employee number or similar that helps identify you
• What personal information you want, being specific, and any information you do not need
• Details or dates that will help the organisation find it
• How you would like to receive the information, and any accessibility needs

How to send it and keep proof

The ICO says you can ask by email, post or through an organisation's online form. Keep a copy, proof of postage or a screenshot of what you sent. Send it to the person or team the organisation names for data protection requests if there is one; if you are asking an employer, writing from your own account to HR or the data protection contact is sensible.

How long they have

The ICO says organisations normally have one month to reply. The clock only starts once the organisation has what it needs from you, such as ID where it reasonably asks, and if your request is unclear it may stop the clock until you explain what you are looking for. If you have made a number of requests or your request is complex, the organisation can take up to an extra two months, but it must tell you within one month of getting the request and explain why.

What you may not get

Asking for everything does not mean you will receive everything. An organisation can sometimes refuse some or all of the information, for example where an exemption applies or where it would reveal information about other people. It should tell you why it is not completing the request and how you can challenge the decision.

If they do not respond

The ICO's guidance for the public says you can complain to the ICO, which can look into your complaint but cannot act as your representative or award compensation, and that you can also seek to enforce your rights through the courts. It strongly advises independent legal advice before going to court.

SAR and the tribunal or court process

A SAR is separate from disclosure in a claim. GOV.UK explains that in an employment tribunal both sides have to share relevant documents with each other and the tribunal, even if they do not help their case, usually under an order that sets a timetable. A SAR made early can help you understand what the employer holds about you and prepare your chronology, but it does not replace that process.