You want to know what a company or former employer holds about you. A well-structured Subject Access Request does not guarantee every document, but it gives you a clear legal route to your personal data.
A SAR Is a Right to Personal Data — Not Automatically Every Document
Under Article 15 UK GDPR, an individual has the right to obtain a copy of their personal data and certain supplementary information about how it is processed. The ICO stresses that a SAR gives access to personal information, not necessarily entire documents.
This distinction is especially important in employment disputes: a SAR is not a substitute for procedural disclosure under the court rules.
How Long Does a Business Have?
The normal deadline is one calendar month from receipt of the request. In certain circumstances, the organisation can extend the deadline by up to a further two months where the request is complex or the person has made a number of requests. It must tell you within the first month that it is extending the deadline and explain why.
If the organisation reasonably needs information to confirm your identity, the response clock does not start until it receives that information. If it asks for clarification, the ICO says the clock can be paused until clarification is received.
"Manifestly Unfounded or Excessive" Has a High Threshold
A controller can refuse a SAR or charge a reasonable fee if it is manifestly unfounded or excessive. The ICO says the threshold is high and the organisation must be able to justify its decision.
A request is not automatically excessive because it covers a lot of information. Context, the relationship between the parties, repetition, overlap and proportionality matter.
How to Write a Stronger SAR
- Address the request to the data controller or privacy team.
- State clearly that you are making a Subject Access Request under Article 15 UK GDPR.
- Describe the categories of personal data you want if that helps locate the information.
- Provide the minimum identity information reasonably necessary for verification.
- State your preferred secure delivery method.
- Keep proof of the date you submitted the request.
What if the Response Is Incomplete?
Compare the response with what you asked for. If you believe information is missing, ask the organisation to review the SAR and explain what categories you say remain outstanding.
There can be lawful exemptions or restrictions, and the ICO notes that organisations must make a reasonable and proportionate search rather than simply hand over everything in every system.
How to Complain to the ICO
The ICO recommends raising the issue with the organisation first. If you remain unhappy or do not receive a proper response, you can complain to the ICO through its data-protection complaint process. Keep your SAR, acknowledgement, response, follow-up correspondence and dates.
The ICO does not act as your lawyer or automatically award compensation. In some cases, court proceedings may be available to enforce the right of access or claim compensation for damage or distress.
What This Means Practically
- Use the exact term "Subject Access Request" and Article 15.
- Track one calendar month, not "30 business days".
- Expect possible extensions only where the legal conditions apply.
- Do not try to defeat the law by sending meaningless bulk requests; focus on the personal data you actually need.
- Preserve the complete paper trail before escalating to the ICO.
Sources
- ICO — A guide to subject access, updated 2026. ico.org.uk
- ICO — What to expect after making a SAR. ico.org.uk
- ICO — When can a SAR be manifestly unfounded or excessive?. ico.org.uk
- ICO — How the right of access can be enforced. ico.org.uk