How to get the information an organisation holds about you
A subject access request uses your right of access under data protection law. Unlike FOI, it works against private companies as well as public bodies, but only for your own personal data.
Your right
Article 15 of the UK GDPR gives you the right to confirmation of whether an organisation is processing your personal data and, if it is, to a copy of that data and information including the purposes, the categories of data and who it has been disclosed to. 1
How to ask
A request does not have to use the words 'subject access request', 'right of access' or 'Article 15'. It just needs to be clear that you are asking for your own personal data, and it can be sent to any part of the organisation. 2
Making a subject access request is free. You can make one for yourself or for another person, for example with their written authority. Organisations may ask for proof of identity. 3
How long they have
Subject access requests must be answered within one month of being received. 2
Information about other people
A subject access request covers only your own data. Information about other people is protected by the same law; it can sometimes be released through a court order or under exemptions for legal proceedings, which are outside the scope of this guide. Official public registers, listed in our directory of registers, are the lawful way to check what people in power have declared.
Complain to the organisation, which must acknowledge within 30 days
Since 19 June 2026 you can complain directly to an organisation if you think it has broken data protection law in handling your personal data. It must make complaining easy, for example with a complaint form you can fill in electronically. 4
The organisation must acknowledge your complaint within 30 days of receiving it, and then, without undue delay, look into it, keep you informed of progress and tell you the outcome. 4
These duties were added to the Data Protection Act 2018 by section 103 of the Data (Use and Access) Act 2025, in force in full from 19 June 2026. 5
Sources
- legislation.gov.uk/eur/2016/679/article/15, read 4 November 2026 · saved copy
- gov.uk/hmrc-internal-manuals/information-disclosure-guide/idg30220, read 4 November 2026 · saved copy
- gov.uk/government/organisations/legal-aid-agency/about/personal-information-charter, read 4 November 2026 · saved copy
- legislation.gov.uk/ukpga/2018/12/section/164A/data.htm, read 4 November 2026 · saved copy
- legislation.gov.uk/ukpga/2025/18/section/103, read 4 November 2026 · saved copy
More ways to hold power to account
- How to make a Freedom of Information request
- How to ask for environmental information (EIR)
- If a public body refuses or ignores your request
- How to check what people in power have declared
- How to make a Freedom of Information request in Scotland
- How to see your council's papers and accounts
- Records you have a right to because of your role
- How to escalate a complaint about government
- How to challenge a public body's decision in court
- Who to blow the whistle to
- Public registers of power and money
This guide explains the rules; it is not legal advice. Report an error.