Subject Access Request Letter
[Your Name]
[Your Address]
[City, State, Zip Code]
[Email Address]
[Phone Number]
[Today's Date]
[Recipient's Name]
[Recipient's Position]
[Company/Organization Name]
[Company/Organization Address]
[City, State, Zip Code]
Subject Access Request
Dear [Recipient's Name],
I am writing to submit a Subject Access Request (SAR) under applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR) and any relevant local data protection laws. I am seeking access to the personal data that your organization holds about me. This request is being made pursuant to my rights as a data subject, as provided by the aforementioned data protection laws.
To assist you in locating my personal data, I have provided the following details:
Full Name: [Your Full Name]
Date of Birth: [Your Date of Birth]
Any other information relevant to my records with your organization: [e.g., customer/account number, member ID, etc.]
If you require any further information from me to process this request, please let me know promptly. I request that you respond to this SAR within the timeframe specified by applicable data protection laws, which is usually one month from the date of receipt of this request.
Please include in your response all personal data that your organization holds about me, including but not limited to:
1. Personal information such as my name, address, email address, and phone number.
2. Financial data, including transactions, payment history, and billing details.
3. Correspondence or communications between your organization and me.
4. Any profile information, preferences, or account settings associated with my account (if applicable).
5. Records of any consents or permissions I may have provided regarding the processing of my personal data.
6. Information regarding the sources from which my personal data was obtained, if not directly from me.
7. Any other personal data that your organization may process about me.
If you are relying on any lawful basis for the processing of my personal data, I request that you clearly specify the legal basis and provide relevant details.
I also request that, if any of the personal data you hold about me is inaccurate or incomplete, you promptly correct or update it accordingly.
Please be aware that as the data subject, I have the right to lodge a complaint with the relevant data protection authority if I believe that my rights under data protection laws have been infringed upon.
Thank you for your attention to this matter. I look forward to receiving a timely response to my Subject Access Request.
Yours sincerely,
[Your Full Name]
[Signature (if sending a physical letter)]
Download Word Doc
Download PDF
Formal Subject Access Request Letter
Subject: Subject Access Request Under Data Protection Law
Dear Data Protection Officer,
I am writing to formally request access to the personal data that your organization holds about me, in accordance with my rights under applicable data protection legislation. Please provide me with a copy of all personal data that you hold, as well as the purposes for which it is being processed.
I would also like to request the following information:
- The categories of personal data being processed
- The recipients or categories of recipients with whom the data has been shared
- The retention period for my data
- Information about my rights to rectification, erasure, and objection to processing
Please consider this letter as my formal Subject Access Request. For identification purposes, I have enclosed a copy of [proof of identity, e.g., passport or driver’s license]. If you require any additional information, please let me know.
I look forward to your response within the statutory time limit.
Sincerely,
[Your Name]
Simple Subject Access Request Email
Subject: Subject Access Request
Dear [Organization Name],
I would like to request a copy of the personal information you hold about me under data protection laws. Please include all records, digital files, and communications linked to my personal data.
For verification, I have attached a copy of my identification. Please let me know if you require anything else to complete this request.
Thank you for your assistance.
Best regards,
[Your Name]
Subject Access Request Letter to Employer
Subject: Request for Access to Personal Data
Dear HR Department,
I am writing to request access to all personal data that [Company Name] holds about me as your employee (or former employee). This includes, but is not limited to, personnel files, payroll records, training records, internal communications mentioning me, and performance appraisals.
Please also provide information about how long this data will be retained and who has had access to it. I have attached a copy of my identification for verification.
I look forward to your response within the legally required timeframe.
Yours faithfully,
[Your Name]
Subject Access Request Letter to Bank
Subject: Request for Personal Data
Dear Data Protection Officer,
I am writing under my right of access to request all personal data that [Bank Name] holds about me. This includes account information, transaction history, communications, and any internal notes or assessments linked to my customer record.
I request full disclosure of:
- All data stored in electronic systems
- Any paper-based records connected to my accounts
- Records of data shared with third parties
I have enclosed identification documents for verification. Please confirm receipt of this request and inform me if any further steps are needed.
Sincerely,
[Your Name]
Subject Access Request Email to Healthcare Provider
Subject: Request for Access to Medical Records
Dear [Healthcare Provider],
I am requesting access to my personal data and medical records held by your practice under my data protection rights. Please provide copies of my full medical history, consultation notes, test results, prescriptions, and any correspondence.
I have attached a copy of my identification to confirm my identity. Kindly ensure that this request is fulfilled within the statutory response time.
Thank you for your assistance.
Sincerely,
[Your Name]
Official Subject Access Request Letter to Government Agency
Subject: Request for Personal Data Under Data Protection Law
Dear Data Protection Officer,
I am writing to formally request access to all personal data about me that is held by [Government Agency]. This request includes any official records, application forms, internal notes, correspondence, and digital files linked to my name or identification details.
Please also inform me of the following:
- How my data is used and stored
- With whom it has been shared
- How long it will be retained
I have enclosed a copy of my identification for verification. I trust this request will be handled promptly within the legal timeframe.
Yours faithfully,
[Your Name]
Preliminary Subject Access Request Message
Subject: Subject Access Request Process
Dear [Organization Name],
I am considering submitting a Subject Access Request and would like to confirm the process with your organization. Could you kindly provide the appropriate contact details, forms (if any), and preferred identification documents required to proceed?
Once I have your confirmation, I will submit my formal request.
Thank you for your guidance.
Best regards,
[Your Name]
Casual Subject Access Request Email
Subject: Request for My Data
Hello [Contact Name],
I’d like to make a Subject Access Request to see the personal information your company holds about me. Could you please share all the records connected with my details, including emails and documents?
I’ve attached my ID for verification. Please let me know if you need anything else.
Thanks a lot,
[Your Name]
What is a Subject Access Request Letter and Why Do You Need One?
A Subject Access Request (SAR) letter is a formal request to an organization asking for a copy of the personal data they hold about you. The purpose is to give individuals control over their personal information, check how it is being used, and ensure it is being processed lawfully. It helps confirm accuracy, request corrections, or challenge misuse.
Who Should Send a Subject Access Request Letter?
- Any individual wanting to know what personal data an organization holds about them.
- Current or former employees requesting workplace records.
- Customers or clients requesting information from banks, telecom providers, or service companies.
- Patients requesting medical or health records.
- Citizens making requests to government or public authorities.
To Whom Should a Subject Access Request Letter Be Addressed?
- The Data Protection Officer (DPO) of the organization.
- The HR department in the case of employment records.
- The Customer service or compliance team for companies.
- The Medical records department for healthcare providers.
- The Official information officer for government agencies.
When Should You Send a Subject Access Request Letter?
- When you suspect inaccurate data is being held.
- If you want a full copy of your employment or medical history.
- When applying for financial services and need to verify records.
- Before legal proceedings to confirm evidence or history.
- After a data breach to understand what information was exposed.
How to Write and Send a Subject Access Request Letter
- Identify the correct recipient (Data Protection Officer or relevant department).
- State your request clearly – mention "Subject Access Request."
- Specify the data you want (all records, specific files, or categories).
- Include proof of identity to avoid delays.
- Send the request in writing by email or post.
- Keep a copy for your records.
Formatting a Subject Access Request Letter
- Length: Typically one page.
- Tone: Clear, formal, and respectful.
- Style: Professional, avoiding unnecessary details.
- Mode of sending: Email is acceptable; postal letter for official cases.
- Attachments: Proof of identity documents.
- Etiquette: Avoid aggressive language, focus on lawful rights.
Requirements and Prerequisites Before Sending a Subject Access Request
- A valid form of identification to verify your identity.
- The correct contact details of the organization’s data protection officer.
- Knowledge of the scope of your request (all records vs. specific ones).
- An understanding of the timeframe for responses (usually one month).
After Sending: What Follow-Up Actions Are Needed?
- Track the response timeline – most organizations must respond within 30 days.
- If the organization requests more information, provide it promptly.
- If you don’t receive a reply, send a polite reminder.
- If the request is ignored, escalate to a regulator (such as the Information Commissioner’s Office in the UK).
- Review the data carefully once received.
Pros and Cons of Sending a Subject Access Request Letter
Pros:
- Helps ensure your data is accurate and lawfully processed.
- Useful for understanding what organizations know about you.
- Can support legal, financial, or personal claims.
Cons:
- May take time to process (up to 1–3 months in complex cases).
- Some organizations may provide minimal data unless pressed.
- You may uncover sensitive or surprising information.
Common Mistakes to Avoid in Subject Access Requests
- Forgetting to include proof of identity.
- Sending the request to the wrong department.
- Making the request too vague (leading to delays).
- Using an overly confrontational tone.
- Forgetting to keep a copy of your request.
Tricks and Tips for Successful Subject Access Requests
- Always use the term "Subject Access Request" in the subject line.
- Keep your request specific but thorough.
- Attach ID upfront to avoid delays.
- Use email for faster responses, unless a physical letter is required.
- Set reminders for follow-up so deadlines are not missed.
Elements and Structure of a Subject Access Request Letter
- Subject line clearly stating "Subject Access Request."
- Introduction explaining why you are writing.
- Details of the data requested (broad or specific).
- Reference to your legal rights under data protection law.
- Proof of identity attached or enclosed.
- Closing statement requesting timely response.
- Signature with your name and contact information.
