MAKE YOUR FREE Data Subject Access Request (DSAR)

Making a Data Subject Access Request online is simple. Just answer a few questions and Rocket Lawyer will build your document for you. When you have all of the details prepared in advance, making your document is a quick and easy process.

To make your DSAR you will need the following information:

Party details

• The details of the business or organisation that you’re sending the DSAR to (including its legal structure, name and address).

• Your details (including your name (and any previous names), address, date of birth and contact details).

Personal data

• Where is the personal data you are requesting access to held? In employment records or personnel files; in pension or benefits records; by a specific department; in billing records; in user activity logs; in medical records; in financial statements; or in another place?

  • If the data is held by a specific department, what is the department’s name?

  • If the data is held in medical records, what are the doctor’s and practice’s names? What are the dates of the medical records being requested?

  • If the data is held in financial statements, what account number do they relate to and what are the dates of the financial statements being requested?

  • If the data is held in another place, where is it being held?

Employment

• Are you a current or former employee of the business or organisation holding your personal data?

  • If you are a current employee, when did you start working for the business or organisation?

  • If you are a former employee, when did you start and stop working for the business or organisation?

Provision of personal data

• Should the requested personal data be provided in electronic and/or hard copy?

Letter

• On what date is the DSAR sent to the business or organisation?

Data Subject Access Requests are used by data subjects (ie individuals) to request a copy of their personal data held by a business or other organisation. As a result, DSARs will typically include:

An introduction

This sets out your right under the Data Protection Act 2018 and UK General Data Protection Regulation (GDPR) to make a DSAR and what exactly this entails. 

Details of the personal data requested

This sets out your request that the business or organisation supplies you with the personal data it holds about you. It then provides details of where the requested personal data is held.

Details to identify the data subject

This sets out details that can be used by the business or organisation to identify you and the personal data you are requesting access to. These details include: 

• your name and any previous or other names you are or have been known by

• your address

• your date of birth

• your telephone number and email address

• if applicable, whether you are a current or former employee of the business or organisation, and your employment start (and, where applicable, end) date

Response to your DSAR

This sets out how you wish to receive a copy of the requested personal data. It also reiterates that, under data protection laws, a business or organisation generally has one calendar month to respond to your letter.

If you want your DSAR to include further or more detailed provisions, you can edit your document. However, if you do this, you may want a lawyer to review or change the DSAR for you, to make sure it complies with all relevant laws and meets your specific needs. Ask a lawyer for assistance.

Understand when it’s appropriate to make a DSAR

Data protection laws give data subjects the ‘right to access’, which grants them the right to request and receive a copy of their personal data. Empowering individuals to make such data subject access requests allows them to understand how and why businesses and other organisations are using their data. It also helps individuals verify that any use of their data is lawful.

Generally, someone can only make a DSAR on their own behalf (ie you can send a request to a business to find out what data they hold on you). However, DSARs can also be made on behalf of another, provided that the individual making the request has the authority to do so. This may be the case if a parent with parental responsibility requests information on behalf of their child, or if someone makes a DSAR under a power of attorney.

For more information, read Making subject access requests.

Remember that you may not always get access to all personal data requested

While businesses or organisations will typically tell you whether they process your personal data and, if they do, provide copies of it, they may not always provide all data you request. Depending on your situation and circumstances, you may only receive some of the data requested or you may receive no data at all. Examples of situations in which you might not receive (all) personal data requested in a DSAR include:

• if the information requested is not actually covered by DSARs (eg you asked for a deceased relative’s medical records)

• if an exemption applies (eg it would prejudice ongoing negotiations)

You should also be aware that a business or organisation may refuse to comply with a DSAR if they believe the request is ‘manifestly unfounded or excessive’ (eg if they believe that you don’t have a genuine intention of accessing the information). If this is the case, they should provide you with their reasoning as to why this is the case.

Be aware that you may have to provide proof of identity

After a DSAR is made and sent, the business or organisation may ask you for proof of ID to carry out identity verification for security reasons.

Where you are asked to provide proof of your identity, the one-month time limit within which the business or organisation has to respond is extended. In fact, the time limit does not start until the business or organisation has received your proof of ID. 

For more information, read Data protection requests.

Be aware that a fee may be charged in some circumstances

Generally speaking, businesses or other organisations should comply with and respond to DSARs free of charge. However, a fee may be charged by the business or organisation if:

• you ask for additional copies of the data requested

• the business or organisation believes your request to be manifestly unfounded or excessive. In this case, a fee can be charged to cover their administrative costs

The one-month time limit for responding to a DSAR doesn’t start until after any required  fee is paid and received.

For more information, read Data protection requests.

Understand when to seek advice from a lawyer

Ask a lawyer for advice if:

• you are making a Subject Access Request on behalf of someone else

• this document does not cover your legal needs

• the business is based outside of England, Wales and Scotland

• a business does not respond to your request