What a SAR Is in Data Protection and How to Use It

Everyone · Explainer · Updated October 1, 2026 · LearnLife Editorial

What is a SAR in Data Protection?

A Subject Access Request (SAR) is a legal tool that allows individuals to ask organizations for any personal data they retain about them. Personal data means any information that can identify you directly or indirectly—such as your name, date of birth, address, phone number, or online identifiers. SARs are part of data protection laws designed to give you transparency and control over your information.

For example, if you shop online, the store may keep records of your purchases, your contact details, and payment information. Through a SAR, you can request to see that data to confirm it is accurate and ask questions about its use.

SARs apply to a wide variety of organizations including businesses, schools, healthcare providers, and government agencies. This right exists so you can be assured your data is handled responsibly and to catch mistakes or unauthorized use early.

How Does a SAR Work? A Step-By-Step Example

When you want to make a SAR, you typically send a written request to the organization. Here’s a clear, hypothetical example of how it works:

Imagine you applied for a credit card and want to know what information the bank holds on you. You write:

"Subject: Subject Access Request Dear Data Protection Officer, I am writing to request a copy of all personal data you hold about me under my right to access. Please provide this information within the legal timeframe. Thank you, [Your Full Name] [Your Contact Information]"

After sending this request, the bank will verify your identity to protect your privacy—this could mean asking for a copy of a photo ID or proof of address. Once verified, they must provide you with the data they have collected, such as your application form, credit checks, correspondence, and how they use your information.

The bank has about one month to respond, although this can be extended by two more months for complex requests. They will send you a copy of the information, often as digital files or printed documents.

Receiving this data helps you understand what the bank knows about you and ensures no errors or misuse exist.

Why Does a SAR Matter for You?

Making a SAR matters because it gives you insight and control over your personal information. It’s your right to know what data organizations keep and how they use it. This knowledge helps you protect your privacy and can reveal mistakes before they cause bigger problems.

For example, if you request a SAR from your mobile phone provider and discover they have outdated or incorrect contact details or billing information, you can ask them to update it. This avoids errors in bills or service issues.

SARs also help detect if your data has been shared with third parties without your permission. If you find your information is passed to advertisers or other companies, you can challenge this or ask for limits on sharing.

In addition, SARs promote transparency and accountability. Organizations knowing that people can request their data are more likely to follow data protection rules carefully.

What Terms Are Often Confused with a SAR?

People sometimes confuse SARs with other data rights or requests, so knowing these differences is useful:

• Data Erasure Request ("Right to be Forgotten"): This is a request to delete your personal data. It’s different from a SAR, which is about accessing data, not removing it.
• Data Portability Request: This allows you to get your data in a structured format to move it to another service—for example, downloading your contacts from one email provider to import them elsewhere.
• Freedom of Information Request: Usually for government bodies to access official records, not personal data about you.
• Right to Rectification: Asking an organization to correct inaccurate personal data.
• Right to Object: Asking an organization to stop processing your data for certain purposes, like marketing.

Understanding these terms helps you make the right request depending on your needs and avoids confusion.

How to Make a SAR: Detailed Steps and Sample Wording

Preparing and sending a SAR can be straightforward if you follow these steps:

1. Identify the organization holding your data. This could be a company, school, or public body.
2. Locate their data protection contact. Most organizations list a Data Protection Officer or Privacy Contact on their website or in privacy policies.
3. Write your request clearly. Include your full name, address, and contact details to help them find your data. Use precise language like:

“I am making a Subject Access Request under data protection law. Please provide me with all personal data you hold about me, including the purposes for processing, data recipients, and retention periods.”

1. Attach proof of identity if requested. Common documents include a driver’s license, passport, or utility bill. This prevents unauthorized access to your data.
2. Send your request via email, postal mail, or an online form if the organization provides one.
3. Keep copies of your request and any correspondence.
4. Track deadlines. Organizations generally respond within one month but may extend by two months for complex requests. If they don’t respond, follow up.
5. Review the data provided carefully and make sure you understand it. If some data is unclear or looks incorrect, write back asking for clarification or corrections.

Being clear, polite, and specific helps the process go smoothly and gets you the information you want faster.

What to Do If Your SAR Is Denied or Ignored?

Sometimes organizations may refuse your SAR or miss the response deadline. They can lawfully refuse if:

• The request is excessive, repetitive, or unfounded.
• Providing the data would infringe on others’ privacy rights.
• There are legal exemptions, such as ongoing investigations.

If you receive a denial, the organization must explain why. If they ignore your request, send a polite follow-up reminding them of their obligation.

If the issue remains unresolved:

• Contact the organization again asking for a review.
• File a complaint with your country’s data protection authority. In the U.S., privacy laws vary by state, so check your local agency.
• Seek legal advice if necessary, especially if sensitive data or serious misuse is involved.

This process helps ensure organizations respect your data rights and follow the law.

How Does a SAR Fit Into Overall Data Protection Rights?

A SAR is part of a broader set of data protection rights that help individuals control their personal information. These rights require organizations to:

• Process data fairly and lawfully.
• Collect only necessary data.
• Keep data accurate and up to date.
• Protect data from unauthorized access.
• Be transparent about how data is used.

SARs give you a way to verify organizations follow these principles. They complement other rights such as the right to correction, deletion, and restriction of processing.

Learning more about data protection, including special categories of data like health information, or understanding online safety rules, strengthens your ability to manage your digital privacy.

For example, knowing how your data is protected on social media platforms can help you decide when to make SARs or change privacy settings.

Frequently asked questions

Can I submit a SAR verbally, or does it have to be in writing?

While some organizations accept verbal SARs, it is best to make your request in writing (email or letter). This creates a record and helps avoid misunderstandings. Written requests allow you to clearly state what you want and keep track of deadlines and responses.

Will the organization charge me for fulfilling my SAR?

Most organizations provide SAR responses free of charge. However, if your request is excessive or repetitive, they can charge a reasonable fee to cover administrative costs. To avoid fees, keep your requests focused and not overly broad.

Can I ask for information about how my data is shared with others in a SAR?

Yes, part of the SAR response should include details about who has received your personal data, such as third-party service providers or partners. This helps you understand where your information travels.

What happens if the data I receive in response to a SAR is inaccurate?

You can request that the organization correct any inaccurate or incomplete data. This is called a right to rectification. Contact them in writing with details on what is wrong and the correct information.

Are SARs only relevant for companies, or do schools and healthcare providers have to respond too?

SAR rights apply broadly, including companies, schools, healthcare providers, and government bodies. Any organization that processes your personal data must respond to a SAR, subject to certain exemptions.

How can SARs help me stay safe online?

By regularly requesting your personal data from online services, you can spot unauthorized activity, understand privacy practices, and make informed decisions about what to share. SARs support your overall online safety and data privacy awareness.