Subject Access Request Template for the UK

Use a Subject Access Request when you need to understand precisely what personal information an organisation holds about you. Common situations include discovering inaccurate data on your credit file, obtaining your complete medical records from the NHS, or verifying what information a former employer retains about you.

This right proves particularly valuable when job hunting, addressing identity theft concerns, or preparing for legal proceedings. It helps you identify and correct inaccurate information, understand how organisations are using your data, and gather evidence if you're experiencing discrimination or unfair treatment. Many individuals submit these requests to social media platforms and tech companies to see the full extent of their collected data and processing activities.

• Standard Subject Access Request Form: The principal form used by individuals to request their personal data from any organisation, typically including identity verification sections and specific details of the data scope required.
• Data Subject Rights Request Form: A broader version encompassing multiple data subject rights, including access, erasure, rectification, and restriction of processing of personal information.
• Enhanced Data Protection Request Form: A comprehensive form incorporating additional privacy protections, frequently used for sensitive data requests involving healthcare providers, financial institutions, or public authorities.

• Individual Data Subjects: Any person seeking to understand what personal information organisations hold about them, including customers, employees, patients, or students.
• Data Protection Officers: Handle incoming Subject Access Requests, coordinate data gathering from across the organisation, and ensure timely compliance with statutory deadlines.
• Legal and Compliance Teams: Review requests for lawfulness, ensure compliance with UK GDPR and Data Protection Act 2018, and advise on information that must be disclosed or may be withheld.
• IT and Systems Teams: Locate and extract requested data from various systems, databases, archives, and cloud storage platforms.
• Records Managers: Maintain organised records and assist in compiling comprehensive, accurate responses to Subject Access Requests.

• Personal Information: Gather your full name, current address, contact telephone number, and email address, together with any account or reference numbers relevant to the organisation.
• Identity Verification: Prepare copies of government-issued identification (passport or driving licence) and recent proof of address (utility bill or council tax letter).
• Request Scope: Specify precisely what information you're seeking—for example, 'all personal data processed by the HR department' or 'communications regarding my employment'—and the time period it covers.
• Organisation Details: State the correct legal name, registered address, and any relevant department or contact reference for the organisation holding your data.
• Supporting Documentation: Include copies of any previous correspondence, reference numbers, or relevant documents that clarify your request.
• Format Preference: Indicate how you'd prefer to receive the information (email, post, or digital format on a portable device).

• Personal Details: Your full name, current address, telephone number, and email address.
• Identity Verification: A clear statement authorising the organisation to verify your identity against provided evidence.
• Data Scope: Specific description of the personal data you're requesting—be as precise as possible to expedite processing.
• Time Period: Clear date range for the information sought, for example, 'all data held from 1 January 2022 onwards'.
• Response Format: Your preferred method of receiving the requested information (electronic or paper copy).
• Legal Rights Reference: Reference to your rights under UK GDPR Article 15 and the Data Protection Act 2018.
• Signature and Date: Your signature (or typed name if submitted electronically) and the date of submission to validate the request.

A Subject Access Request differs substantially from an Access Agreement. Whilst both address access rights, they operate for distinct purposes under different legal frameworks.

• Legal Foundation: Subject Access Requests are statutory privacy rights under UK GDPR that allow individuals to view their personal data, whereas Access Agreements are contractual arrangements governing access to facilities, systems, or shared information between organisations.
• Timing and Duration: Subject Access Requests are single-instance requests with a mandatory 30-day response deadline, whilst Access Agreements typically establish ongoing relationships with fixed term lengths, renewal provisions, and notice periods.
• Parties Involved: Subject Access Requests are initiated by individuals exercising their fundamental data protection rights, whereas Access Agreements are mutual contracts between organisations and authorised users or partner entities.
• Scope and Content: Subject Access Requests concern only viewing personal data already held, but Access Agreements cover broader usage permissions, restrictions, confidentiality obligations, liability, and termination rights.