Subject access request
Somebody asking for the personal data you hold about them. One month, usually free.
Please note: This page explains what a term means. It is general information, not legal, financial, tax or investment advice, and it does not know anything about your business. Before you sign, file or commit to anything, check it with an accountant, a solicitor, or the official guidance we link to.
What it means
A subject access request entitles an individual to a copy of their personal data and information about how it is processed.
Why it matters
It can be made verbally or in writing, to anyone in the organisation, in any form. There is no required wording, which is why they are often not recognised as SARs at all.
What it looks like in practice
One month to respond, extendable by two for complex requests. Usually free; a fee is only chargeable for manifestly unfounded or excessive requests.\n\nThird-party data and certain exemptions allow redaction, not blanket refusal.
What to watch out for
Employment disputes. SARs are routinely used tactically before a tribunal claim, and emails about the person are personal data — including the ones managers would rather not disclose.
Where to get proper advice
The ICO's SAR guidance and its right of access detailed guidance. A solicitor where litigation is in prospect.
Where to read more
Last reviewed 2026-08-28 by Fiducia Together · Next review due 2027-08-28
Please note: This page explains what a term means. It is general information, not legal, financial, tax or investment advice, and it does not know anything about your business. Before you sign, file or commit to anything, check it with an accountant, a solicitor, or the official guidance we link to.
Fiducia Together