What to expect after making a subject access request

23 May 2024 - We have rewritten the guidance to explain when the clock stops and when the clock is paused.

What actions should I take after making a request?

Keep a record of your request

• keeping a copy of any emails or letters;
• keeping any proof of postage or delivery, eg a postal reference number; or
• taking a screenshot before sending your request (if you used an online form or portal).

If you don’t have this information (eg if you made the request over the phone or in person), write down the information about what you asked for and when. It’s helpful if you include (where applicable):

• the date and time you asked for the information;
• where you were, eg a branch of a bank;
• the number you called or a link to the online form you used;
• the number you called from, eg your mobile, home number or work number;
• the name of the staff member you spoke to;
• the information you asked for;
• any reference numbers given to you by the organisation; and
• any other relevant information.

Provide proof identification (if asked)

ID checks are sometimes needed to check you are the person asking for the information and to protect your personal information. When asked for ID, you should provide it.

Click to toggle details When is the organisation likely to ask you for ID?

We would expect an organisation to ask you for ID if you’ve asked for sensitive information, such as health or finance information. They might ask for ID if they don’t recognise your details. For example, if you send a SAR from an email address that doesn’t match the one in their records or you use an online service that doesn’t require you to login.

We wouldn’t expect the organisation to ask you for ID when they are confident about your identity when you make your request. For example, if you make a request to your employer from your work email, or you have a live chat where you have to confirm your email and order number.

If you make a request for another person, the organisation will probably need proof that you have the person’s permission. If they ask you for this proof you must provide it.

The one-month time limit for the organisation to reply to your request only starts once they have what they need from you.

Provide more information (if asked)

Organisations might ask you for more information about what it is you’re requesting. Three common reasons for this are:

1. They have lots of information about you and want to narrow down the search.
2. They will struggle to respond to the SAR without it, eg they don't understand what you are asking for.
3. You have made a similar SAR in the past and the organisation wants to know if you want the same information or new information.

If the organisation contacts you to ask for more information, they can stop dealing with your request until you reply (eg by email, letter or phone). You don’t need to give them the information they ask for, but it may help the organisation find the information you want. However, you must reply to them, even if it is just to say you aren’t giving them what they have asked for. We recommend you work with the organisation to help them understand your SAR where possible, as this will help you get what you need.

How long does the organisation have to reply to me?

Organisations normally have one month to reply to your request. If your request is unclear, an organisation may stop the clock until you explain what information you are looking for.

However, if they ask you for ID, the clock only starts when they have what they need from you.

If you’ve made a number of requests or your request is complex, the organisation may need extra time to consider it. They can take up to an extra two months to respond. If they are going to do this, they must let you know within one month of getting your request, and explain why they are taking longer.

The extra two months don’t apply when you’re asking for information collected or used for law enforcement reasons. This covers most information collected by the police.

If an organisation chooses to charge a fee, the one-month time limit doesn’t begin until you have paid the fee.

See our detailed guidance on time limits for more details .

How much does a subject access request cost?

Normally, organisations can't charge for responding to your SAR. An organisation can charge a reasonable fee to cover their administrative costs if they think your request is ‘ manifestly unfounded or excessive ’.

They can also charge a fee if you ask for further copies of your information following a request. I ntelligence services can always charge £10 for a SAR, if they choose to.

• Share this page
• Print this page
• RSS feeds