What to Do If Your Subject Access Request Is Ignored

You've sent a Subject Access Request (SAR) to an organisation asking for your personal data. The one-month deadline has passed. You've heard nothing — or you've received a vague response that doesn't actually provide what you asked for.

This is frustratingly common. Many organisations ignore SARs hoping people will give up. The good news is you have real enforcement options, and the Information Commissioner's Office (ICO) takes these complaints seriously.

This guide explains exactly what to do when your SAR is ignored, delayed, or refused.

Step 1: Send a Formal Follow-Up Letter

Before escalating to the ICO, send a formal follow-up letter. This creates a paper trail and gives the organisation one final chance to comply. It also strengthens your ICO complaint if they still don't respond.

Send this by email (for a timestamp) and keep a copy. If you have a postal address, consider sending a hard copy too.

Step 2: Complain to the ICO

If the organisation still doesn't respond — or responds inadequately — you can complain to the Information Commissioner's Office. The ICO is the UK's data protection regulator and has powers to investigate and enforce compliance.

How to Submit Your ICO Complaint

You can complain online through the ICO website at ico.org.uk/make-a-complaint. You'll need:

• A copy of your original SAR
• Proof of when you sent it (email confirmation, postal receipt)
• Any responses you've received (or confirmation of no response)
• Your follow-up letter and proof it was sent
• A clear explanation of what's happened

What Happens After You Complain

The ICO will review your complaint and may:

• Contact the organisation to investigate
• Request evidence of their response (or lack of it)
• Order the organisation to comply with your SAR
• Issue a reprimand or enforcement notice
• In serious cases, issue a fine

The ICO typically responds within a few weeks, though complex cases can take longer. They will keep you informed of progress.

Step 3: Consider Legal Action

If the ICO route doesn't resolve the issue — or if you need faster results — you can take legal action in the courts.

Court Order to Comply

Under section 167 of the Data Protection Act 2018, you can apply to the County Court (or High Court) for an order requiring the organisation to comply with your SAR. This is a relatively straightforward application if the organisation has clearly failed to respond.

Compensation Claims

Under Article 82 of UK GDPR, you may be entitled to compensation if you've suffered:

• Material damage — financial loss caused by not having the data
• Non-material damage — distress, anxiety, or inconvenience

Compensation claims can be made alongside an application for a compliance order, or separately. Small claims (under £10,000) can be handled through the County Court small claims track without needing a solicitor.

Common Reasons SARs Are Ignored (and How to Address Them)

"We didn't receive your request"

This is why sending by email (with a read receipt if possible) or recorded post matters. If you can prove delivery, this excuse falls apart. Your follow-up letter should reference the original delivery evidence.

"Your request wasn't clear enough"

UK GDPR doesn't require SARs to be in any particular format. If your request made clear you wanted your personal data under data protection law, it's valid. However, if they genuinely need clarification, they should have asked within a reasonable time — not after the deadline passed.

"We need more time"

Organisations can extend the deadline to three months for complex requests. But they must tell you within the first month, explain why, and keep you updated. Simply going silent isn't acceptable.

"We're claiming an exemption"

There are legitimate exemptions under UK GDPR — for example, data covered by legal professional privilege, or data that would reveal information about other people. But the organisation must tell you which exemption applies and why. A blanket refusal without explanation is not valid.

How to Strengthen Your Position

To give yourself the best chance of success:

• Keep records of everything — every email, letter, and phone call
• Set clear deadlines in your correspondence
• Be specific about what data you're requesting
• Stay professional — angry letters are less effective than firm, clear ones
• Follow up in writing after any phone conversations

What If You're Outside the UK?

UK GDPR applies to organisations based in the UK, or organisations outside the UK that process UK residents' data. If you're outside the UK but dealing with a UK organisation, you still have the right to make a SAR.

The ICO can still investigate complaints from people outside the UK, as long as the organisation being complained about is subject to UK data protection law.

Summary: Your Enforcement Options

When your SAR is ignored, you have three main routes:

1. Follow-up letter — Give them 14 days and put them on notice
2. ICO complaint — Free, takes a few weeks, can result in enforcement action
3. Legal action — Court order to comply and/or compensation claim

Most organisations will comply once they receive a formal follow-up or learn that an ICO complaint has been made. The key is not giving up — your right to access your data is protected by law, and there are real consequences for organisations that ignore it.