Subject Access Request

This document is a subject access request which can be used by an individual to request that an organisation provides:

• confirmation that they are processing the individual's personal data;
• a copy of that personal data;
• the purposes of their processing;
• the categories of personal data concerned;
• the recipients or categories of recipient they disclose the personal data to;
• their retention period for storing personal data or, where this is not possible, their criteria for determining how long they will store it;
• confirmation of the existence of the right to request rectification, erasure or restriction or to object to such processing;
• confirmation of the right to lodge a complaint with the ICO or another supervisory authority;
• information about the source of the data, where it was not obtained directly from the individual;
• the existence of any automated decision-making (including profiling); and
• the safeguards they provide if they transfer personal data to a third country or international organisation.

How to use this document

The document should be signed and sent to the organisation. If the organisation has a data protection officer, or provide details of who to contact for privacy or data issues, that address should be used to enable the organisation to deal with the complaint. The individual sending the request may wish to keep a copy for their own records.

After the request has been sent the organisation should respond within one month.

Any Applicable Law

General Data Protection Regulation

Data Protection Act 2018

How to modify the template

You fill out a form. The document is created before your eyes as you respond to the questions.

At the end, you receive it in Word and PDF formats. You can modify it and reuse it.