Subject Access Request Form Template for the United States

A Subject Access Request Form is a legal document that allows you to formally request access to personal information that organizations hold about you. Under various United States privacy laws, you have the right to know what data companies collect, how they use it, and in many cases, obtain copies of your personal information. This form provides a standardized way to exercise these rights while ensuring organizations can process your request efficiently and in compliance with applicable regulations.

When do you need this document?

You need this form whenever you want to access personal information held by organizations subject to U.S. privacy laws. Healthcare providers must respond to requests under HIPAA, allowing you to access your medical records and health information. Credit reporting agencies must provide your credit report under the Fair Credit Reporting Act (FCRA). Educational institutions must grant access to student records under FERPA. In California, businesses covered by the CCPA must disclose what personal information they collect and how they use it. Federal agencies must respond to requests under the Privacy Act of 1974. You may also need this form when investigating identity theft, reviewing employment records, or understanding how businesses use your data for marketing purposes.

Key legal considerations

The identity verification section is crucial because organizations must confirm your identity before releasing personal information to prevent unauthorized disclosure. You'll typically need to provide government-issued identification and may need to include additional verification if requesting information on behalf of someone else. The data request details section should be specific about what information you're seeking and the time period involved, as this helps organizations locate relevant records efficiently. Be aware that organizations may charge reasonable fees for processing requests, particularly for extensive searches or multiple copies. Response timeframes vary by law – HIPAA allows 30 days, while the CCPA requires responses within 45 days. Some information may be exempt from disclosure, such as data that would compromise others' privacy or reveal trade secrets.

Legal requirements in United States

Under HIPAA, covered entities must provide access to protected health information within 30 days and may charge reasonable copying fees. The FCRA requires consumer reporting agencies to provide free annual credit reports and respond to requests within 15 days. FERPA gives parents and eligible students the right to inspect education records within 45 days of a request. The California Consumer Privacy Act grants California residents the right to know what personal information businesses collect and requires responses within 45 days, with possible 45-day extensions. Federal agencies under the Privacy Act must respond within 10 working days, though extensions are common for complex requests. Organizations must verify your identity using reasonable methods, which may include requiring notarized signatures for sensitive information. If you're requesting information on behalf of someone else, you'll need proper authorization, such as a power of attorney or written consent from the data subject.