Subject access request (SAR) – General information

Aim of this page

The aim of this page is to provide some general information about subject access requests (SAR) including what information you’re entitled to, how to apply for it and how to raise a concern if you think your information is incorrect.

This forms part of our information on other areas of life.

Why is this important?

Everybody has the right under the Data Protection Act 2018 to make a request to any organisation, for a copy of the information that organisation holds about you.

There are many reasons why you may want to apply for an SAR. It could be to find out the reason why a certain decision has been made about you, for example an assessment about your performance at work. You might want to establish whether a company has the correct information about you; may be you want to know whether your employer is still keeping details of a conviction which has recently become spent. It’s important to know how to go about getting this information and also, what you can do if an organisation refuses to give it to you.

What is a subject access request (SAR)?

A subject access request is simply a verbal or written request under the Data Protection Act 2018 to an organisation asking for copies of personal data and any other supplementary information that organisation holds about you. An SAR enables you to understand how and why an organisation is using your data and to check that they are doing it lawfully.

What Information are you entitled to ask for?

A SAR gives you the right to request:

• whether the organisation is processing your personal data;
• a copy of the personal data they hold about you;
• any other supplementary information.

In addition, you may also want to ask to be provided with details of:

• the purpose for which your data is being processed
• the types of personal data being processed
• any third parties that your data is being shared with
• how long your data will be kept for
• how you go about making a request to have your data amended or deleted
• how the organisation became aware of data if it was not provided directly by you
• whether the organisation uses any automated decision-making processes.

Applying for your SAR

You can make a SAR request to an organisation verbally or in writing. If you make your request verbally, it’s recommended that you follow it up in writing to provide a clear trail of correspondence. Most organisations will have details on their websites or in their privacy policies as to how you can apply for your SAR.

When making a subject access request you should provide the organisation with the following information:

• Your name and contact details
• Any information used by the organisation which would distinguish you from others with the same name (for example an account number)
• Specific details of the information you require together with any relevant dates – this should help the organisation deal with your request more quickly.

The ICO have a template letter which can be used when applying for your SAR.

Always keep a copy of your request together with proof of postage or delivery.

A SAR should be free of charge, although organisations can charge a reasonable administrative fee if you require additional copies or they believe that the SAR is ‘manifestly unfounded or excessive”. The organisation will have one month to respond to your request, but in certain circumstances can extend the time to an extra two months. In this case, they should inform you of the extension and the reason why it is needed.

Can an organisation refuse to provide you with an SAR?

An organisation may refuse your request if your data includes information about another individual, except where:

• The other individual has agreed to the disclosure, or
• It is reasonable to provide you with the information without the other individuals’ consent.

The organisation may also refuse if they believe that the request is ‘manifestly unfounded or excessive’.

In either case, they will need to provide you with the reason for their refusal.

How can you raise a concern regarding your SAR?

If you’re  unhappy with the way the organisation has handled your SAR you should first make a complaint to them.

If their reply does not resolve your concern than you can make a complaint to the Information Commissioners Office (ICO)

Useful links

Below you will find links to useful websites relating to this page.

• ACRO Criminal Records Office (ACRO) – is the national police unit, who process subject access requests for information held on the Police National Computer (PNC) on behalf of most UK police forces.
• Information Commissioners Office (ICO) – an independent body set up to uphold information rights. Their website provides more information and advice about SAR and how you can raise a complaint with them if an organisation doesn’t deal with your personal data properly.

More information

1. For practical information – More information can be found on police records – subject access request
2. Questions – If you have any questions about this, you can contact our helpline.

Get involved

Help us to add value to this information.  You can:

1. Comment on this page (below)
2. Send your feedback directly to us
3. Discuss your views and experiences with others on our online forum
4. Share your personal story by contributing to our online magazine, theRecord