Subject access requests: getting information about you — Easy Read

Choose the right information right

Use a subject access request, often called a SAR or DSAR, for information about you. You can ask a public service, employer, business, charity or other organisation covered by data protection law. Examples include your support notes, an employer’s emails about you, or a company’s recorded calls with you. Freedom of Information requests are mainly for recorded information about public bodies, such as a council’s policy or spending. A request containing both types should be handled under the relevant rules for each part.

Decide what you want to receive

You can ask for all your personal information or choose particular services, records and dates. You can also ask how it is used, where it came from and who receives it. The right concerns your information; it does not always mean receiving every original document in full. An organisation must make reasonable and proportionate searches. A broad request is not automatically excessive, but useful dates, names of services or account references can help it find what matters to you.

Contact the organisation holding the information

Look for its privacy notice or data protection contact. An email, letter or spoken request can be valid. You do not need to quote legislation, give a reason or use its particular form. Say clearly that you want a copy of your personal information. Include enough details to identify you and locate the records. Keep the request and date. Different organisations may hold different records, so ask each one separately where needed. See our health, social care and support records guide for examples.

Ask for the access and communication you need

Explain whether you need large print, an accessible electronic file, a telephone explanation or help using the request process. Ask for an explanation of unfamiliar codes and abbreviations. A response should be clear and understandable. Agree a secure delivery route you can use. Do not post private records or identity documents on a public request website. If the response is upsetting, you can choose someone you trust to read it with you.

Getting help without losing control

You can authorise an advocate or another person to request or receive information for you. Say what they may do and what they may see. The organisation can check their authority. A parent, partner, carer or next of kin does not automatically have access to an adult’s records. A learning disability does not automatically mean someone cannot decide. If a person cannot make this decision, the organisation must check the applicable legal authority and safeguards. Children have their own information rights; parental access is not unlimited.

Identity checks and the usual deadline

The organisation must respond without undue delay, normally within one calendar month. This means a calendar month, not 30 working days. Where reasonably needed identity information, evidence of a representative’s authority or a lawful fee is required, the deadline is calculated from the relevant receipt date. Identity checks should be proportionate; a passport is not automatically necessary. Ask what is needed, why and how to send it securely. Ask the organisation to confirm the exact deadline for your request.

When the deadline can change

For requests received from 5 February 2026, clarification reasonably needed to identify the information or processing can pause the clock. It resumes after the clarification arrives. An organisation cannot force you to narrow your request simply to make it easier. A complex request, or the number of requests from you, can justify up to two extra months; the organisation must explain this within the initial month. Most police law-enforcement records have different rules and do not have this two-month extension. Ask which rules apply.

Fees, refusals and information about others

Most SARs are free. A reasonable administrative fee can apply to further copies, or to a request that is manifestly unfounded or excessive. That means there must be a clear justification; asking for a lot is not enough by itself. The organisation may instead refuse a request meeting that threshold. Other legal exemptions can protect information, including another person’s privacy. Parts may be hidden, called redacted. Ask for the reason and complaint route, as far as the law allows it to explain.

Check what has arrived

Compare the response with your dates, services and types of information. Note particular gaps and ask what was searched. Ask for missing information to be supplied or for an explanation of why it is not held or has been withheld. Some responses may be extracts rather than whole documents. Keep your copy safe. Waiting for a SAR does not automatically pause a tribunal, court, benefit appeal or service complaint deadline. Get advice about any separate deadline.

Ask for wrong facts to be corrected

The right to rectification means you can ask for inaccurate personal information to be corrected, or incomplete information to be completed. Identify the entry, the error and the correction you want. Give supporting evidence if available. An earlier mistake may need to stay alongside the correction as part of an accurate history. A clearly recorded opinion is not automatically wrong just because you disagree. Ask for your disagreement to be recorded and challenge the underlying decision separately if needed.

Complain to the organisation first

If the response is late, incomplete or wrongly refused, explain the problem to the organisation’s data protection contact. Include your request date, reference and what you want put right. Under the complaints rules in force from 19 June 2026, it must acknowledge a data protection complaint within 30 days, counted from the next day. A deadline falling on a weekend or public holiday moves to the next working day. This is an acknowledgement deadline, not a deadline for finishing the investigation. It must investigate, keep you informed and give an outcome without unjustifiable or excessive delay. A complaint does not replace its SAR duties.

Take an unresolved concern to the ICO

The ICO is the data protection regulator. You can complain after giving the organisation a chance to put things right. Send the request, relevant replies, your complaint and the outcome or evidence of delay. The ICO recommends raising concerns within three months of your last meaningful contact with the organisation. This is its complaint guidance, not a general court time limit. The ICO does not act as your representative or award compensation. Get independent legal advice before considering court action.

Use the request planner privately

The worksheet helps you organise a request; it is not a form you must use. Keep a private copy. Leave out information that is not needed. Send your finished request directly to the organisation through a suitable channel. You can say: “Please provide a copy of my personal information covering the services and dates listed. Please include the information about how my data is used. I need the response in the following format.” Keep a separate note of any checks, clarification, extension or complaint.

Getting information about you

Information about you

Choose what to ask for

Ask the right place

Speaking or writing

Ask for help to read it

Choose someone to help

Safe identity checks

The usual time limit

Sometimes the deadline changes

Most requests are free

Some information may be hidden

Check the information

If something is wrong

Get more help

What you can do next

More useful links