Subject Access Request Template - Example 2 - Monaco Solicitors (2024)

FAQs

How to make a subject access request example? ›

Dear [put their name if you know it, or the name of the service], I would like a copy of the following personal data that you hold about me, and which I have a right to view under the Data Protection Act 2018: [Include a list of all the information you want.

An individual can make a SAR verbally or in writing, including on social media. A request is valid if it is clear that the individual is asking for their own personal data. An individual does not need to use a specific form of words, refer to legislation or direct the request to a specific contact.

You can ask for all the information an organisation holds about you. However, this doesn't mean you will get all the information they have about you. An organisation can sometimes refuse to provide you with all or some of the information. It might also mean you get a lot of information back that you don't need.

Dear [Recipient Name], I am writing to request access to [system or resource name] for [purpose or project]. I understand that this access will require [specify any requirements such as training, approval, or authentication]. To provide some context, [briefly explain the purpose or project that requires access].

Ask as soon as possible and in writing. This can either be by letter or email. Seeking your personal data is known as making an access request or a data subject access request. You should state in the letter or email that it is an access request.

Dear Sir/Madam, SAR Subject Access Request. Please supply the personal data you hold about **child's name**, which I am entitled to receive under the 1998 Data Protection Act. This is to include all records; copies of all e-mails, faxes, letters, copies of all telephone messages, copies of all internal memos.

Any data held about a person, including information in emails, provided the requester is identifiable and the information relates to them as an individual, will usually constitute personal data for the purposes of a subject access request.

You should also note that individuals do not have to tell you their reason for making the request or what they intend to do with the information. However, it may help you to find the relevant information if they do explain the purpose of the request.

You can also refuse to comply with a SAR if it is: manifestly unfounded; or. manifestly excessive.

What to disclose in a subject access request? ›

As well as the requester's personal data, you need to send your privacy information. They have a right to know why you hold their data, how you got it, how long you're planning on keeping it, who you share it with, and how they can ask for it to be changed (such as updating their address) or deleted.

Organisations normally have one month to reply to your request.

A SAR should be free of charge, although organisations can charge a reasonable administrative fee if you require additional copies or they believe that the SAR is 'manifestly unfounded or excessive”.

complex; or. you have received a number of requests from the individual – this can include other types of requests relating to individuals' rights. For example, if an individual has made a SAR, a request for erasure and a request for data portability simultaneously.

Are emails included in a subject access request? Any data held about a person, including information in emails, provided the requester is identifiable and the information relates to them as an individual, will usually constitute personal data for the purposes of a subject access request.

How much does a subject access request cost? Normally, organisations can't charge for responding to your SAR. An organisation can charge a reasonable fee to cover their administrative costs if they think your request is 'manifestly unfounded or excessive'.