I want to access all data a company holds about me. How do I do this?

What the Law Says

Under UK data protection law, you have the right to obtain a copy of the personal data an organisation holds about you. This is called a subject access request (SAR). The rules are set out in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The UK GDPR gives individuals the right to request access to their personal data. A company must confirm whether it is processing your data, and if so, provide a copy of that data along with other key information — such as why it’s being processed, who it’s shared with, and how long it will be kept.

The Data Protection Act 2018 supports and supplements the UK GDPR. It sets out exemptions and clarifies how public authorities and certain sectors must handle SARs.

Companies must respond without undue delay and in any event within one month of receiving the request. This period can be extended by two further months where requests are complex or numerous — but the company must inform you within one month and explain why the extension is needed.

Statutory Text

The controller shall provide the information requested… without undue delay and in any event within one month of receipt of the request.

— UK GDPR, Art. 12(3) — Transparent information, communication and modalities for the exercise of the rights of the data subject

Statutory Text

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee… or refuse to act on the request.

— UK GDPR, Art. 12(5) — Transparent information, communication and modalities for the exercise of the rights of the data subject

Statutory Text

The information must be provided in writing, or by other means, including, where appropriate, by electronic means.

— UK GDPR, Art. 12(1) — Transparent information, communication and modalities for the exercise of the rights of the data subject

Sources