Subject Access Request

What is a subject access request?

A subject access request (SAR) is a formal request to obtain personal information held by an organisation.

Is it mandatory to make a subject access request in writing?

No. It is possible to make a verbal subject request. However, a request in writing can be helpful so that there is a written record of:

• the date of the request
• the contents of the request
• the legal basis of the request

What does data processing mean?

Data Processing refers to an organisation holding and/or using a person's personal information. The personal information being processed could have been gathered through a number of ways, such as through surveys or online forms, saving the personal data in databases, sharing the personal information with third parties, using personal information to create profiles, updating personal information with current data (e.g. address details).

Who is a data subject?

A data subject is the person who owns the data or the person whose personal data is being held. While it is more common for natural persons to be data subjects, it is also possible for an organisation (e.g. a company) to be a data subject as the organisation could have legal personality and therefore have personal data.

What is personal data?

Personal data means any information relating to an identified or identifiable natural person (a data subject). It is therefore information from which a person may be identified directly or indirectly. Examples of personal data include a data subject's:

• name
• address
• email address
• telephone number
• IP address
• health information
• criminal information

Who should send/create a subject access request?

The subject access request should be sent by the data subject. This person can either be a natural person or an organisation with a legal personality. The subject access request can also be sent by an authorised representative of the data subject where the data subject is incapable of doing it themselves.

What has to be done once a subject access request is ready?

Once the subject access request is ready, it should be signed and sent to the organisation either by post or electronically via email.

Proof of the data subject's identity should usually be provided with a subject access request (such as a copy of the driving licence or passport).

If the subject access request is made by a third party with authority to act on behalf of the data subject, copies of any evidence to confirm their authority to act should be attached to the request (e.g. a power of attorney).

The organisation should provide a response within 28 days.

What documents should be attached to a subject access request?

Proof of the data subject's identity should be provided with a subject access request (such as a copy of the driving licence or passport).

If another person is making the request on the data subject's behalf, then they should attach proof of their authority to make the request. For example, this may include a copy of a power authority, or the data subject's written consent.

What are the costs involved in finalising a subject access request?

Under the law, a person can make a subject access request for free, however, in some cases, an organisation can ask that a fee should be paid in order to process the request. These include:

• if the request being made is excessive
• if there is a request for additional copies of the data
• if the same data has been provided in the past

Can a recipient organisation refuse the subject access request?

Yes, there are situations in law that permit an organisation to refuse a request. Where this is the case, the full reasoning should be sent out in the organisation's response. An example of such a situation is where the information being requested is covered by legal privilege, if the information is confidential or if processing the request will infringe on the rights and freedoms of another person.

Can the response be disputed?

If the sender wishes to dispute a response to a subject access request they can:

• raise this with the Information Commissioner's Office (ICO)
• raise a dispute in the civil court

What must a subject access request contain?

A subject access request should contain:

• the identity of the data subject (name, date of birth, full address, copy of proof of identity)
• a description of the information being requested (i.e. the type of data and the periods to which they relate)
• the data subject's preferred format for receiving the information (i.e. either hard copy or electronic)
• contact information of the recipient organisation

What laws apply to a subject access request?

The main legal provisions that apply to a subject access request are:

• The UK General Data Protection Regulation
• Data Protection Act 2018

It is also possible to obtain information, advice and guidance from the Information Commissioner's Office (ICO) about the use and retention of their data.

Help from a lawyer

You can choose to consult a lawyer if you need help.

The lawyer can answer your questions or help you through the process. You will be offered this option when you complete the document.

How to modify the template?

You fill out a form. The document is created before your eyes as you respond to the questions.

At the end, you receive it in Word and PDF formats. You can modify it and reuse it.