What is a data subject access request?
Definition
A data subject access request (DSAR) is a request you make to an organisation to get a copy of the personal data it holds about you. In the UK it's your right of access under UK GDPR, and it's usually free.
Full glossary“You can also ask them for copies of your personal information. This is called the right of access and is also known as making a subject access request, a SAR or a DSAR.”
- Category
- Privacy
- Also called
- DSAR, subject access request, SAR
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: ico.org.uk
Last verified against the official page:
A data subject access request, also called a subject access request or SAR, is how you use your right of access. The ICO, the UK data protection regulator, describes the right as your entitlement to find out what personal data an organisation holds about you and to get a copy.
How to make one
Anyone can make a request, and you don't need a solicitor. The ICO says it can go online through many organisations' websites, by email, by post, over the phone or face to face. It helps to put "subject access request" in the subject line, give enough details for the organisation to find you, and say what information you want. If you're asking for someone else's data, you need to show you have their permission.
How long it takes and what it costs
Organisations normally have one month to reply. The clock may not start until they have what they need from you, and for complex or multiple requests they can take up to two more months. In most cases they can't charge a fee, except where a request is manifestly unfounded or excessive, or you ask for further copies of what you've already received.
If a month has passed with no answer, the ICO's advice is to send a follow-up email or letter. You can complain to the ICO if you're still unhappy.
What you get back
A copy of your personal data and information about how it's used. Some information can be withheld under exemptions, for example where it would reveal details about other people.
DSAR vs. an opt-out or deletion request
A DSAR asks what the organisation holds. It doesn't make them delete anything. To have data removed you send a separate erasure request, or use the company's opt-out process.
EU and UK rules give this right. The US has no single equivalent, though some state laws give similar access rights.
How to protect yourself
- 1
Send your request in writing and keep a copy
Email works well. Put "subject access request" in the subject line and save the date you sent it, because the one-month clock runs from receipt.
- 2
Be specific about what you want
Say which accounts, dates or departments. Vague requests are slower and can be queried.
- 3
Chase after a month
If you've heard nothing after a month, send a follow-up. If that fails, you can complain to the ICO.
- 4
Follow up with an erasure request if needed
Once you can see what they hold, ask for what you don't want kept deleted.
- 5
Find the companies you don't know about
You can only ask companies you know hold your data. Serus finds the data brokers and people-search sites that list you and removes your listings.
See it in action
The law
- Australia (Commonwealth) Australian Privacy Act access request template (APP 12)
- California CCPA: how to delete, see and stop the sale of your data in California
- Connecticut Connecticut Data Privacy Act (CTDPA): deleting people-search profiles and your other rights
- Delaware Delaware Personal Data Privacy Act (DPDPA): your rights and how to use them
- European Union GDPR rights explained: access, erasure, objection and how to complain
- European Union GDPR subject access request template: a letter you can copy
- Indiana Indiana Consumer Data Protection Act: your rights since January 1, 2026
- Kentucky Kentucky Consumer Data Protection Act (KCDPA): your rights and how to use them
- Maryland Maryland Online Data Privacy Act (MODPA): your rights and how to use them
- Minnesota Minnesota Consumer Data Privacy Act (MCDPA): your rights and how to use them
- Montana Montana Consumer Data Privacy Act (MCDPA): rights, opt-out signals and the 2025 changes
- Nebraska Nebraska Data Privacy Act (NDPA): your rights and how to use them
- New Jersey New Jersey Data Privacy Act (NJDPA): your rights, deadlines and the coming data broker registry
- Oregon Oregon Consumer Privacy Act (OCPA): your rights and how to use them
- Canada (federal private sector) PIPEDA access request template: a letter for Canadians
- Rhode Island Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA): your rights and how to use them
- Texas Texas Data Privacy and Security Act (TDPSA): your rights and how to use them
- United Kingdom UK GDPR: your data rights and how to use them
- United Kingdom UK subject access request template: a SAR letter you can copy
- Virginia Virginia Consumer Data Protection Act (VCDPA): your rights and how to use them
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Do I have to pay for a DSAR?
Usually not. The ICO says organisations can't normally charge a fee, except where a request is manifestly unfounded or excessive, or you ask for further copies.
How long do they have to respond?
Normally one month. It can be extended by up to two more months for complex or multiple requests.
Do I need a solicitor?
No. Anyone can make a SAR themselves.
Can I make a DSAR for someone else?
Yes, with their permission. You need to show the organisation you're authorised to ask.
Sources
- Right of access · ico.org.uk
- Getting copies of your information (SAR) · ico.org.uk
- Time limits for responding to data protection rights requests · ico.org.uk
Something wrong or out of date? Tell us and we'll re-check it.
