Your data rights
Data Subject Access Request (DSAR): how to ask what a company holds on you
A plain-language guide to the right that lets you ask any organisation for a copy of the personal data it holds about you — and how to use it yourself.
In short
A Data Subject Access Request (DSAR) is your right under the UK GDPR to ask any organisation for a copy of the personal data it holds about you. You send a short written request, and the organisation must usually respond within one calendar month, free of charge, explaining what it holds and why.
What a DSAR is
A Data Subject Access Request lets you ask an organisation to confirm whether it holds personal data about you and, if so, to give you a copy along with information about how and why that data is used. It is one of the core rights that data-protection law gives every individual.
Under the UK GDPR (Article 15), the right of access applies to your personal data — broadly, any information that relates to you as an identified or identifiable person. That can include the obvious, such as your name and contact details, and the less obvious, such as records of your activity or notes an organisation has made about you.
How to make a request
You do not need a special form or a lawyer. A short written message — by email or letter — that clearly says you are asking for your personal data is enough. Include enough detail for the organisation to find your records and confirm who you are.
- Address it to the organisation, using its privacy or data-protection contact if one is listed.
- State clearly that you are making a data subject access request.
- Describe the information you are looking for, if you have something specific in mind.
- Keep a dated copy of what you send.
What to expect back
The organisation usually has one calendar month to respond, and in most cases cannot charge a fee. It should provide a copy of your data and an explanation of how it is used.
If your request is complex, the organisation may extend the deadline by up to two further months, but it must tell you within the first month. Some information can be withheld under limited exemptions. If you are unhappy with the response, you have the right to complain to the Information Commissioner's Office (ICO).
Frequently asked questions
How long does an organisation have to respond?
Usually one calendar month from the date it receives your request and confirms your identity. The deadline can be extended for complex requests, in which case the organisation should tell you within the first month.
Does it cost anything?
In most cases a data subject access request is free. An organisation can only charge a reasonable fee in limited situations, such as requests that are clearly unfounded or excessive.
What if a company does not respond?
If an organisation does not reply or refuses without a valid reason, you can raise a complaint with the Information Commissioner's Office (ICO).
Related terms
This is general information, not legal advice. For guidance on your own situation, consider speaking with a qualified professional.
Reviewed by OSINTA's founding lawyer — 2026-06-27.
Ready to make your own request?
OSINTA helps you understand your own footprint and exercise your own rights — you stay in control of every step.