How to write a DSAR (the parts that actually matter)

What a good DSAR actually needs

A DSAR does not need legal language, a special form, or a lawyer. Under the UK GDPR (Article 15), any clear written request for your personal data counts — so the goal is simply to be unambiguous and easy to act on. A request that names the right, identifies you, and says what you want is far quicker to handle than a long or vague one.

Three things do most of the work: stating plainly that this is a data subject access request, giving the organisation enough to find your records and confirm who you are, and keeping a dated copy of what you sent. Everything else is optional detail. This is general information, not legal advice.

• The phrase that signals your right: 'data subject access request' or 'right of access under Article 15'.
• Enough identifying detail — your name and any account or reference number — without oversharing.
• A clear note of what you are looking for, if you have something specific in mind.
• A dated copy kept for your own records.

Write it in this order

Following a simple order keeps the request short and complete. You can work straight down this list and stop when you have covered each point — most DSARs fit comfortably in a few short paragraphs.

• 1. Find the right contact — look for a privacy, data protection, or DPO email; if there is none, the organisation's general support address is fine.
• 2. State the request — say clearly that you are making a data subject access request under the UK GDPR.
• 3. Identify yourself — give your name and any account, customer, or reference number that helps them locate your records.
• 4. Say what you want — ask for a copy of your personal data, or name the specific records if you have something particular in mind.
• 5. Set the expectation — note that you understand they usually have one calendar month to respond.
• 6. Add your contact details — say how you would like to receive the response.
• 7. Date it and keep a copy — record when you sent it, so you can track the one-month window.

A template you can copy and adapt

Replace the placeholders in square brackets with your own details. Keep it polite and brief — you do not need to explain why you are asking.

Subject: Data Subject Access Request — [your name]. Dear [organisation name], I am making a data subject access request under the UK GDPR (Article 15). I would like a copy of the personal data you hold about me, along with information about how and why it is used. My details for identification are: [your name], [account or reference number if you have one], [email or address on file]. Please send your response to [your email or postal address]. I understand you usually have one calendar month to respond. Thank you. [Your name], [date].

If you later want to ask for data to be corrected or deleted, those are separate rights — rectification and erasure (Article 17) — and you would write a short, similar request naming the right you are using. This is general information, not legal advice.

Frequently asked questions

Related terms

• Data Subject Access Request (DSAR)
• Data controller
• Data protection regulator