Subject Access Request

A Subject Access Request (SAR) is a request made by an individual to an organization to gain access to their personal data that the organization holds.

Overview

Under data protection laws, individuals have the right to request a copy of the information that an organization holds about them.

When to Make a Request

You might want to make a Subject Access Request if:

  • You want to know what personal data is held about you.
  • You believe your personal data has been mishandled.
  • You wish to ensure your personal data is accurate and up-to-date.

How to Make a SAR

  1. Identify the Data Controller: Determine who is processing your personal data.
  2. Submit Your Request: Write to the organization, providing details such as:
    • Your name and contact details
    • Specific information you want to access
  3. Wait for a Response: The organization must respond within one month, though this may be extended in complex cases.

What You Can Expect

Upon receiving your request, the organization should:

  • Confirm whether they hold any personal data about you.
  • Provide you with a copy of your personal data, where applicable.
  • Explain the purpose of processing the data and any recipients of the data.

Important Considerations

  • Organizations may charge a fee for excessive or repetitive requests.
  • Certain information may be exempt from disclosure, including data concerning other individuals.