Subject Access Requests (SAR / DSAR)
A practical guide to your right to access personal information held about you, including the current deadline, search standard and what a response should contain.
What a SAR gives you
A subject access request is the usual way to exercise the right of access. You do not need to use the words “SAR”, “DSAR” or cite Article 15. A valid request can be verbal or written and can be made through ordinary contact channels.
The right is to your personal information, not necessarily to every document that mentions you. The response should normally include a copy of the relevant personal data plus supplementary information such as the purposes of processing, categories of data, recipients, retention information and your rights.
DSAR (“data subject access request”) is commonly used, but the ICO generally uses SAR. They refer to the same right of access in this context.
How to make a useful request
You can simply ask for the personal information you want. Being specific can make the response easier to assess, but an organisation cannot force you to narrow a request merely because it would prefer a smaller search.
Identify yourself and the account or relationship
Give enough information to help the organisation locate the right records without oversharing identity documents unnecessarily.
Describe the information
For example, specify a date range, department, account, call recordings, CCTV or correspondence if that reflects what you actually need.
Keep proof of receipt
Save the email, webform confirmation, postal delivery record or screenshot. The receipt date drives the deadline.
When the clock starts
The normal limit is one calendar month. If necessary identity information is reasonably requested, the timescale does not start until that information is received. That is different from clarification about the scope of a SAR, which can pause an already-running clock where clarification is reasonably required.
If the request is complex or the person has made a number of rights requests, the organisation may extend the time by up to a further two months. It must notify the person and explain why within the initial one-month period.
Read the detailed SAR deadline guide →
Clarification after the DUAA
An organisation may ask for clarification of the information or processing activity the SAR relates to, but only where clarification is reasonably required to give an effective response. The clock pauses on the day clarification is requested and resumes the day after clarification is received. The requester cannot be forced to narrow a request; if they maintain a broad request, the organisation still has to carry out reasonable and proportionate searches.
What search is required?
The Data (Use and Access) Act 2025 made explicit that an organisation responding to a SAR is required to carry out a reasonable and proportionate search for relevant personal information. That does not permit a token search, but nor does the right necessarily require every conceivable system to be searched regardless of burden and relevance.
If you believe obvious records are missing, ask what systems, date ranges, custodians or search terms were checked. The adequacy of the search can be part of a data-protection complaint.
Can information be withheld?
Yes. The right of access is important but not absolute. Exemptions and restrictions may apply to particular information. Common issues include legal professional privilege, information about other people, crime and taxation, confidential references, management information, negotiations, health or social-work information, and requests considered manifestly unfounded or excessive.
An organisation should consider exemptions case by case. If it refuses all or part of the request, it should explain the reasons, tell you about your right to complain to the organisation and the ICO, and tell you that the right can be enforced through the courts.
If the response is incomplete or late
Check the actual deadline first. If the organisation is late or you believe the search, redactions or refusal are inadequate, make a data-protection complaint to the organisation. Since 19 June 2026, controllers have a statutory complaint-handling duty. They must provide a complaint route, acknowledge a complaint within 30 days, investigate it and communicate an outcome without unjustifiable or excessive delay.
If the matter remains unresolved, you can complain to the ICO. The ICO recommends raising the matter within three months of your last meaningful contact with the organisation.
Simple SAR wording
Official sources
- ICO – A guide to subject access
- ICO – Detailed right of access: responding to a request
- ICO – SAR exemptions
- Data Protection Act 2018
- Data (Use and Access) Act 2025
Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.