Your data rights
Data subject access request (DSAR): How to ask what a company holds about you
A plain-language guide to the right that lets you ask any organisation for a copy of the personal data it holds about you — and how to use it yourself.
In short
A Data Subject Access Request (DSAR) is your right under the UK GDPR to ask any organisation for a copy of the personal data it holds about you. You send a short written request, and the organisation must usually respond within one calendar month, free of charge, explaining what it holds and why.
What a DSAR is
A Data Subject Access Request lets you ask an organisation to confirm whether it holds personal data about you and, if so, to give you a copy along with information about how and why that data is used. It is one of the core rights that data-protection law gives every individual.
Under the UK GDPR (Article 15), the right of access applies to your personal data — broadly, any information that relates to you as an identified or identifiable person. That can include the obvious, such as your name and contact details, and the less obvious, such as records of your activity or notes an organisation has made about you.
How to make a request
You do not need a special form or a lawyer. A short written message — by email or letter — that clearly says you are asking for your personal data is enough. Include enough detail for the organisation to find your records and confirm who you are.
- Address it to the organisation, using its privacy or data-protection contact if one is listed.
- State clearly that you are making a data subject access request.
- Describe the information you are looking for, if you have something specific in mind.
- Keep a dated copy of what you send.
What to expect back
The organisation usually has one calendar month to respond, and in most cases cannot charge a fee. It should provide a copy of your data and an explanation of how it is used.
If your request is complex, the organisation may extend the deadline by up to two further months, but it must tell you within the first month. Some information can be withheld under limited exemptions. If you are unhappy with the response, you have the right to complain to the Information Commissioner's Office (ICO).
Where the right of access comes from
It is easy to read a Data Subject Access Request as a feature of one particular law. It is better understood as the everyday use of something much older: the idea that a person should be able to know what is recorded about them. Privacy and human dignity were named as fundamental human rights long before modern data-protection statutes existed — the Universal Declaration of Human Rights set them down in 1948, and the first binding international data-protection treaty, Council of Europe Convention 108, followed in 1981.
Seen this way, the UK GDPR does not hand you the right of access; it interprets and gives practical shape to a right you already hold. Article 15 is simply the mechanism — the agreed way to exercise the underlying human right to see and understand the information held about you. Laws of this kind translate a fundamental principle into steps an ordinary person can actually take.
That is the whole point of a request: to make an abstract right real. OSINTA is built for exactly this — not as a law firm or an adviser, but as a safe tool for exercising your own rights, working only with openly available information and only about you. You stay in control of every step.
This guide is for information only — not legal advice, and not the rules of any particular country. It describes a universal right and a calm, general way to use it.
- The right to know what is held about you predates any single data-protection law — it grows from privacy and human dignity as fundamental rights.
- The UK GDPR's right of access (Article 15) is the mechanism for exercising that right, not the source of it.
- OSINTA is a safe tool for using your own rights, not a legal adviser — it works only with public information, and only about you.
Frequently asked questions
How long does an organisation have to respond?
Usually one calendar month from the date it receives your request and confirms your identity. The deadline can be extended for complex requests, in which case the organisation should tell you within the first month.
Does it cost anything?
In most cases a data subject access request is free. An organisation can only charge a reasonable fee in limited situations, such as requests that are clearly unfounded or excessive.
What if a company does not respond?
If an organisation does not reply or refuses without a valid reason, you can raise a complaint with the Information Commissioner's Office (ICO).
Related terms
This is general information, not legal advice. For guidance on your own situation, consider speaking with a qualified professional.
Reviewed by OSINTA's founding lawyer — June 2026.
Ready to make your own request?
OSINTA helps you understand your own footprint and exercise your own rights — you stay in control of every step.