My Subject Access Request was refused or ignored. How do I complain to the ICO?

Short answer

If an organisation fails to respond to your Subject Access Request (SAR) within one month, refuses it without adequate reason, or provides an incomplete response, you can complain to the Information Commissioner's Office (ICO). The ICO can require the organisation to comply and, in serious cases, issue fines of up to £17.5 million or 4% of global annual turnover under the UK GDPR.

Before complaining to the ICO, you should raise the issue directly with the organisation. Give them a short additional period to respond (usually 14 days). The ICO expects you to have tried to resolve the matter with the organisation before escalating. Keep records of all correspondence and the original SAR.

1 The rule

The right to make a Subject Access Request and the ICO's enforcement powers are set out in

The organisation must respond to a SAR within one month of receipt. If the SAR is complex or involves a large volume of data, they may extend by a further two months with explanation. They may charge a reasonable fee only if the request is "manifestly unfounded or excessive". They cannot require you to use a specific form, and a SAR made by any means (including email or verbal) triggers the obligation.

2 What you can do now

1. 01
   Check whether the organisation has breached the SAR rules

   The most common SAR failures are: (1) no response within one month; (2) partial response — only some data disclosed, with no explanation for what has been withheld; (3) refusal on grounds that do not apply (for example, claiming the data is commercially sensitive when that is not a valid exemption); (4) excessive redaction — blanking out information that should have been provided; and (5) failure to provide supplementary information (such as the purposes of processing, retention periods, and third parties data has been shared with). Compare the response against the full list of information required under <a href="https://www.legislation.gov.uk/eur/2016/679/article/15" target="_blank" rel="noopener noreferrer">UK GDPR, Article 15</a>. If you are unsure what a valid SAR should contain, the <a href="/articles/how-to-write-subject-access-request" class="body-link">how to write a Subject Access Request article</a> covers the requirements.

2. 02
   Chase the organisation in writing and give a final deadline

   Send a written follow-up (email is fine) referring to your original SAR, the date it was sent, the response (or lack of response) received, and the specific deficiencies. Give the organisation 14 days to provide a complete response. Be specific — "your response failed to include the categories of personal data processed, the names of third parties data was shared with, and your retention period for my employment records" is more effective than a general complaint. This letter also creates a paper trail for the ICO complaint.

3. 03
   Submit a complaint to the ICO

   If the organisation does not remedy the deficiency, complain to the ICO at <a href="https://ico.org.uk/make-a-complaint/" target="_blank" rel="noopener noreferrer">ico.org.uk/make-a-complaint</a>. You will need to provide: a description of your SAR and when you made it; evidence of your correspondence; the organisation's response (or non-response); and the specific information you believe is being withheld. The ICO will assess whether the organisation has complied with the UK GDPR. Most SAR complaints are handled within three to six months, though complex cases take longer.

4. 04
   Consider a county court claim for damages if you have suffered harm

   The ICO's enforcement primarily focuses on compliance — requiring the organisation to respond — rather than awarding you compensation. If the SAR refusal caused you financial loss or significant distress, you can bring a claim for damages under <a href="https://www.legislation.gov.uk/ukpga/2018/12/section/168" target="_blank" rel="noopener noreferrer">Data Protection Act 2018, s.168</a> in the county court, independently of any ICO complaint. The claim must be issued within six years of the breach. Material distress (genuine, significant distress — not mere annoyance) is compensable. See the <a href="/guides/debt/county-court-money-claim" class="body-link">county court money claim guide</a> for the court process.

3 When this does not apply

• Exemptions: organisations can refuse or redact a SAR on specific statutory grounds — for example, preventing crime, safeguarding vulnerable adults, legal professional privilege, or "manifestly unfounded or excessive" requests. Check whether the exemption claimed is set out in Schedule 2 of the Data Protection Act 2018 and actually applies to your data.
• Third-party data: organisations may redact personal data about identifiable third parties (other than the requester). Reasonable redaction of third-party information is permitted.
• Employment references: references given in confidence are exempt from SARs in most circumstances.
• Health data: if the SAR concerns health data, the organisation may consult a healthcare professional before responding to assess whether disclosure would cause serious harm. This may extend the response time.

4 Common questions