How to make a subject access request for your personal information
How to ask an organisation for your personal data, narrow the request and challenge missing or unreadable information.
Last reviewed: 6 July 2026 · UK guidance
In brief
A subject access request asks an organisation for personal data it holds about you and information about how it is used. It is different from a Freedom of Information request, which concerns recorded information held by public authorities.
You do not need a special form or legal wording. Identify yourself, the organisation and the data or period needed. A focused request can be answered more usefully than “everything ever held”, while still preserving your rights.
Send the request to the data controller
Use the organisation’s privacy or data-protection contact. State that you are making a subject access request, give enough information to locate records and specify preferred accessible format. Keep proof of submission.
Narrow by service, person or date
Ask for case notes, call recordings, emails about a decision, account logs or records between dates. Include previous names or reference numbers if needed. Do not send identity documents until the organisation explains a secure and proportionate verification route.
Understand what may be withheld
Some information about other people, legal privilege, crime prevention or specific regulated records may be restricted. The organisation should explain exemptions where appropriate rather than silently omitting material.
Review the response methodically
Compare the index or chronology with known events. Note missing dates, unreadable redactions, unexplained codes and inaccurate data. A subject access response is not automatically proof that every decision was lawful.
Challenge delay or incomplete disclosure
Contact the data-protection officer with specific gaps and request explanation. If unresolved, use the organisation’s complaint route and the relevant data-protection regulator. Separate requests to correct inaccurate data from disagreements about professional opinion.
Make a focused subject access request
Send to the privacy or data-protection contact.
I am making a subject access request for my personal data relating to [service, account or decision] from [date] to [date]. This includes [notes, emails, recordings or logs]. My reference is [number]. Please provide it in [accessible electronic format], explain any withheld information and use a secure method if identity evidence is required.
A practical checklist
- Use a subject access request for your personal data.
- Specify services, dates and record types.
- Verify identity through a secure proportionate route.
- List missing items before escalating.
Check the current information
These are the most relevant official or specialist places to confirm live rules, availability and application details.
ico.org.uk
Open official informationgov.uk
Open official informationcitizensadvice.org.uk
Open official informationChoose one next action
You do not need to finish everything today. Find a relevant organisation through National Help, or save the action you want to return to in your Support Plan.
HiddenHelp explains options and helps you organise a next step. It does not decide eligibility, make awards, or replace regulated legal, medical or financial advice.