SAR Template Letters — Free Subject Access Request Templates

Subject: Subject Access Request under UK GDPR Dear Sir/Madam, I am writing to make a Subject Access Request under Article 15 of the UK General Data Protection Regulation and section 45 of the Data Protection Act 2018. Please provide me with: 1. Confirmation of whether you are processing my personal data 2. A copy of all personal data you hold about me 3. Information about the purposes of processing 4. The categories of personal data concerned 5. The recipients to whom my data has been disclosed 6. The retention period for my data 7. Information about the source of any data not collected from me directly My details for identification purposes: Full name: [YOUR FULL NAME] Address: [YOUR ADDRESS] Date of birth: [YOUR DATE OF BIRTH] Email: [YOUR EMAIL ADDRESS] [Any account numbers, reference numbers, or other identifiers: [REFERENCE NUMBER]] I enclose a copy of [my passport/driving licence] to verify my identity. Under UK GDPR, you must respond to this request within one calendar month. Please confirm receipt of this request. Yours faithfully, [YOUR NAME] [DATE]

Subject: Subject Access Request - [YOUR NAME] - Employee/Staff Number [YOUR EMPLOYEE NUMBER] Dear [HR DEPARTMENT / DATA PROTECTION OFFICER], I am writing to make a Subject Access Request under Article 15 of the UK GDPR. I [am currently employed / was employed] by [COMPANY NAME] from [START DATE] to [END DATE / present] in the role of [JOB TITLE]. Please provide me with all personal data you hold about me, including but not limited to: • My personnel file and employment records • All emails where I am named or referenced • Performance reviews and appraisals • Disciplinary records and investigation notes • Grievance records • Sickness and absence records • Payroll records and P60s • Training records • Any notes or minutes from meetings about me • CCTV footage featuring me (if still retained) • IT system logs relating to my account • Any data held by third parties on your behalf (e.g., occupational health providers) My details: Full name: [YOUR FULL NAME] Employee/staff number: [EMPLOYEE NUMBER] Department: [DEPARTMENT] Dates of employment: [START DATE] to [END DATE] Date of birth: [DATE OF BIRTH] Email used during employment: [WORK EMAIL] Personal email: [PERSONAL EMAIL] I enclose a copy of my [passport/driving licence] for identity verification. Please respond within one calendar month as required by UK GDPR. Yours faithfully, [YOUR NAME] [DATE]

Subject: URGENT: Overdue Subject Access Request - [YOUR NAME] Dear [DATA PROTECTION OFFICER / ORGANISATION NAME], I am writing regarding my Subject Access Request dated [DATE OF ORIGINAL SAR], which is now overdue. Under Article 12(3) of the UK GDPR, you were required to respond within one calendar month — by [DEADLINE DATE]. I have not received a response. Your failure to respond is a breach of UK GDPR. I am giving you 14 days from the date of this letter to provide a full response to my request. If I do not receive a complete response by [DATE 14 DAYS FROM NOW], I will: 1. Make a formal complaint to the Information Commissioner's Office 2. Consider applying to the court for a compliance order under section 167 of the Data Protection Act 2018 3. Reserve my right to claim compensation under Article 82 of UK GDPR For reference, my original request was for [BRIEF DESCRIPTION OF WHAT YOU REQUESTED]. My details remain: Full name: [YOUR NAME] Address: [YOUR ADDRESS] Date of birth: [DATE OF BIRTH] [Reference numbers: [REFERENCE]] Please treat this matter as urgent. Yours faithfully, [YOUR NAME] [DATE]

Subject: Incomplete Response to Subject Access Request - [YOUR NAME] Dear [DATA PROTECTION OFFICER], Thank you for your response dated [DATE] to my Subject Access Request. However, I believe your response is incomplete. [Choose relevant points below:] MISSING DATA: I expected to receive [DESCRIBE MISSING DATA] but this was not included. I know this data exists because [EXPLAIN HOW YOU KNOW - e.g., "I received emails from your organisation that reference this information" or "this data was discussed in meetings"]. Please confirm what searches you conducted and which systems you checked. EXEMPTIONS: You have withheld data citing [NAME THE EXEMPTION THEY CLAIMED]. I do not believe this exemption applies because [EXPLAIN WHY]. Please provide a detailed explanation of how each piece of withheld data meets the legal requirements of this exemption. REDACTIONS: You have redacted information citing third party data. However, [EXPLAIN WHY YOU BELIEVE REDACTIONS ARE EXCESSIVE OR WRONG]. I request that you: 1. Conduct further searches for the missing data 2. Provide the wrongly withheld data 3. Explain in detail why any exemptions apply Please respond within 14 days. If I remain unsatisfied, I will escalate this matter to the Information Commissioner's Office. Yours faithfully, [YOUR NAME] [DATE]