Guide
What to write in a subject access request
Updated
The reason a subject access request template is worth having is not that the law demands particular words. It demands none. It is that a request written without thinking about scope invites a clarification exchange, and since 5 February 2026 that exchange costs you days off your own deadline.
The four sentences that are doing the work
Identify yourself well enough to be found. Not just a name: whatever reference the organisation actually files you under, such as an employee number, an account number, or the email address you dealt with them from.
Say what it is. A line saying you are making a subject access request under Article 15 of the UK GDPR removes any argument about whether they understood what arrived.
Say what you want, as tightly as you honestly can. Everything is a lawful request. A named system, a date range and a subject matter is a request that gets answered faster and more completely.
Ask for it electronically. Article 15(3) provides that where the request is made by electronic means, "the information shall be provided in a commonly used electronic form" unless you request otherwise.
Two lines worth adding
Ask expressly for the Article 15(1) information as well as the data. That is the confirmation that processing is happening, the purposes, the categories of personal data, the recipients or categories of recipient, the envisaged retention period, the source of the data where it did not come from you, and the existence of any automated decision-making. It is the part most often left out of a response, and it is frequently more useful than the data itself, because it tells you who else has your information.
Note the date and the method of sending. The relevant time under Article 12A(2)(a) is when the controller receives the request, so a route that produces a delivery record settles the only fact about the deadline that is worth arguing over.
What not to put in
A reason. You do not have to give one, and giving one invites a discussion about whether it is a good reason, which is not a test the legislation applies.
A threat about the deadline before anything has gone wrong. It changes the tone of the reply and it buys nothing: the deadline exists whether or not you mention it.
A dispute. If the request is part of a grievance or a claim, keeping the two separate is usually better for both, and mixing them makes it easier for the response to answer the argument instead of the request.
Where to send it
To the controller. The privacy notice for the service you used names it and gives a contact route for data protection questions, and using that route is the fastest way to reach somebody who knows what a subject access request is.
Where more than one organisation was involved, each is a separate controller and each needs its own request. One letter to the brand you dealt with does not reach the payment processor or the delivery firm. If you are not sure who holds what, asking for the categories of recipients under Article 15 first will tell you where to write next.