WHAT THE ICO SAYS

Ask what they
hold on you.

Your life leaves a trail of records.

Employers, shops, banks and apps all keep personal information about you. UK data protection law gives you the right to ask any organisation whether it holds your information and to get a copy. It is called a subject access request.

ASK it is your right

Check the timing

A neat stack of printed pages held with a bulldog clip beside an open laptop and a cup of tea on a kitchen table in afternoon light — AI-generated image, not a photograph of a real person or place.

Anyone can ask
Usually free
Usually one month
Your information, on request

THE SHORT ANSWER

Ask clearly,
keep a record.

The right of access covers organisations of all kinds.
Here is what the ICO says to expect.

ASKING

Anyone can ask

You can ask an organisation whether it uses or stores your personal information, and for copies. The ICO says you don't need a solicitor or a lawyer.

How to ask

TIMING

Usually one month

Organisations normally have one month to reply. Complex or repeated requests can take up to two extra months, but they must tell you within the first month.

Check the timing

THE REPLY

More than copies

Along with your information, the reply should say what it is used for, who it is shared with and how long it will be kept, and how to complain to the ICO.

See the numbers

General information only, not legal advice. For advice on your own situation, speak to a qualified lawyer or a free advice service.

A QUICK TIMING CHECK

When does
the clock run?

Pick a situation to see how the ICO describes the time limit. The bar shows how long you may have to wait.

Timing check

Choose a situationA clear, simple requestThey ask for IDYour request is unclearComplex or many requestsThey charge a fee

A clear, simple requestOne month

Organisations normally have one month to reply to your request.

They ask for IDStarts on ID

ID checks are more likely for sensitive information such as health or finance. The one-month limit only starts once they have what they need from you.

Your request is unclearClock paused

If they ask what you mean, they can stop dealing with the request until you reply. You must reply, even just to say you are not giving more detail.

Complex or many requestsUp to 2 more months

They can take up to an extra two months, but must tell you within one month of getting the request and explain why.

They charge a feeStarts on payment

A fee is only allowed in limited cases, such as further copies. If one is charged, the one-month limit begins once you have paid.

Source: ICO, What to expect after making a subject access request. The ICO says this guidance is under review after the Data (Use and Access) Act 2025.

Based on the ICO's public guidance on subject access requests. This is general information, not legal advice.

TWO NUMBERS WORTH KNOWING

Free and fast,
most of the time.

One number on time,
one on cost.

1 month

Normal time to reply

Organisations normally have one month to reply. For complex or many requests they can take up to an extra two months, except for information collected for law enforcement reasons.

TIME LIMIT · ICO

£0

Normal charge for a request

Normally organisations can't charge. A reasonable fee is allowed if a request is manifestly unfounded or excessive, or for further copies. Intelligence services can always charge £10.

COST · ICO

The ICO suggests writing "subject access request" in the subject line, saying exactly what you want, and keeping a copy or screenshot of what you sent.

FOUR STEPS FROM ICO GUIDANCE

Ask once,
ask well.

A clear request is easier to answer. These steps follow the ICO's own suggestions for the public.

Find the right contact
The privacy notice or website usually names who deals with requests. Many organisations have an online form.
Be specific
Head it "subject access request", give your name, reference numbers and dates, and say what you want and how you want to receive it.
Keep a record
Save copies of emails, proof of postage or a screenshot of an online form. Note the date, time and who you spoke to on the phone.
Follow up, then complain
No reply after a month? Follow up in writing. Still unhappy? Complain to the organisation first, then to the ICO.

Rows of grey archive boxes on metal shelving in a quiet records room — AI-generated image, not a photograph of a real person or place.

Hands sealing a plain white envelope beside a notebook and a pen on a wooden table — AI-generated image, not a photograph of a real person or place.

THE 2025 LAW CHANGE

A clock that
can pause.

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. GOV.UK says it clarifies the time limits for subject access, including a "stop the clock" rule while an organisation waits for information it needs from you.

It also says organisations need to make reasonable and proportionate searches. The changes are brought in stages, 2 to 12 months after Royal Assent, and the ICO is reviewing its guidance.

Questions

Questions people ask

Do I need a solicitor to make a request?

No. The ICO says anyone can make a subject access request and you don't need a solicitor or a lawyer. You can ask online, by email, by post, by phone or face to face.

Does a subject access request cost anything?

Normally organisations can't charge. They can charge a reasonable fee if they think a request is manifestly unfounded or excessive, or for further copies. Intelligence services can always charge £10.

Can I make a request for someone else?

Yes, if you can prove you have their permission, for example with written permission or a power of attorney document. The organisation does not have to hand over information if it is not satisfied.

Will I get full copies of documents?

Not always. You are entitled to your personal information, not the original documents. A bank could give you a list of transactions instead of statements, and other people's details can be blacked out.

What if I get no reply?

If it has been over a month, the ICO suggests a written follow-up. If you are still unhappy, complain to the organisation first and keep copies, then you can complain to the ICO.

Ask what they
hold on you.