What Is a Subject Access Request (SAR)? A Complete Guide Under UK GDPR (2026)

Written By Simon Stadnyk

1. Introduction to Subject Access Request (SAR)

A Subject Access Request (SAR) is a legal request that allows you to obtain a copy of the personal information an organisation holds about you.

In the UK, this right is protected by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

A SAR can be made to employers, local authorities, the NHS, banks, universities, schools, insurance companies, and many other organisations.

2. What is personal data?

The GDPR has a wide-ranging definition of ‘personal data’. It includes anything from an individual’s name to biometric, online and geolocation identifiers; this list is not limited:

  • name

  • address

  • emails

  • CCTV footage

  • disciplinary records

  • HR files

  • medical records

  • complaint files

  • call recordings

  • and much more

3. To whom can I send a Subject Access Request (SAR)?

  • employers

  • councils

  • NHS trusts

  • police

  • schools

  • universities

  • landlords

  • housing associations

  • banks

  • retailers

  • insurers

4. What information can I ask for in a Subject Access Request?

  • copies of personal data

  • purposes of processing

  • categories of data

  • recipients

  • retention periods

  • source of the data (where applicable)

5. How to make a Subject Access Request

  1. Identify the organisation.

  2. Contact the correct department of the organisation.

  3. Send your SAR via email or post it.

  4. State in your SAR that it is a Subject Access Request.

  5. Provide enough information to identify yourself: name, address, contact number.

  6. Explain what information you require (if appropriate).

  7. Keep a copy of your request.

6. Do I need to use a special form for a Subject Access Request?

The answer is no. A SAR can even be made verbally. Many organisations provide online forms, but they cannot generally require you to use them if another valid request has been made.

7. How long does the organisation have ?

Normally - One month.Then explain when it can be extended.

8. Can an organisation refuse my Subject Access Request?

Yes. An organisation may refuse to comply with a Subject Access Request (SAR) in certain limited circumstances. However, under the UK General Data Protection Regulation (UK GDPR), the right of access is a fundamental right, and organisations should not refuse requests simply because responding is inconvenient or time-consuming.

9. What if they ignore or refuse my Subject Access Request?

  • Ask the organisation to explain the legal basis for its refusal.

  • Request clarification if you believe the refusal is incorrect or incomplete.

  • Consider making a complaint to the Information Commissioner's Office (ICO).

  • Seek independent legal advice if the refusal has caused you significant prejudice or you believe your data protection rights have been infringed.

    A refusal does not necessarily mean the organisation has acted lawfully. Each case depends on its specific facts, the information requested, and the legal basis relied upon by the organisation.

10. Can I ask for CCTV?

Yes, but only footage showing you, and organisations may redact or withhold parts where necessary to protect others' rights.

11. Can employees make SARs?

Definitely. Include examples:

  • disciplinary investigations,

  • grievance files,

  • performance reviews,

  • HR records,

  • emails,

  • internal notes (subject to applicable exemptions and context).

Conclusion

A Subject Access Request is a powerful legal right that helps individuals understand how organisations use their personal data. Whether you're dealing with an employer, a public authority, or a private company, making a well-prepared SAR can be an important first step in resolving a dispute or understanding what information is held about you.

This article is for general information only and does not constitute legal advice. If you need advice about your specific circumstances, you should seek independent legal advice or contact me at info@semenstadnyk.com.

Simon Stadnyk