Short answer
Under UK GDPR you have the right to request a copy of all personal data an organisation holds about you. This is called a Subject Access Request (SAR). The organisation must respond within one month and cannot charge a fee for most requests.
Personal data includes your name, contact details, transaction history, call recordings, emails, complaints, and any notes staff have made about you. The organisation must provide it in an intelligible form.
1 The rule
The right of access is one of the core data subject rights under UK GDPR. It allows you to verify whether your personal data is being processed and to obtain a copy of it.
"The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data."Read the official text
The right applies to data held in both digital and paper records. If the organisation cannot identify you from the information you provide, it may ask for further verification — but it cannot demand excessive identification.
2 What you can do now
- Identify the data controller
The data controller is the organisation that decides how your personal data is used. For a retailer, it is the company you bought from. For an employer, it is the employer entity. You can find their data protection contact details — often a Data Protection Officer (DPO) — on their privacy policy or the ICO's register at ico.org.uk.
- Write your request
There is no required form. Write to the DPO or privacy team stating that you are making a Subject Access Request under Article 15 of UK GDPR, describe the data you want (the more specific the better — for example "all emails containing my name between January and June 2026"), and state your full name and any account reference. Send by email and keep a copy with the date.
- Wait for the one-month deadline
The organisation has one calendar month from the day it receives your request. If the request is complex or you have made multiple requests, it may extend to three months — but must tell you within the first month that it is doing so. Silence after one month is a breach.
- Review what you receive
Check that the response is complete. The organisation may redact third-party personal data but must not use that as a reason to withhold your data. Note any data that looks wrong or that you believe should have been included.
- Escalate if unsatisfied
If the organisation refuses, ignores your request, or provides an incomplete response, complain to the ICO at ico.org.uk/make-a-complaint. The ICO can order the organisation to comply and investigate systemic failures. You can also apply to the court for an order under section 167 of the Data Protection Act 2018.
3 When this does not apply
- The data is covered by an exemption — for example legal professional privilege, or data processed for crime prevention and detection.
- The request is manifestly unfounded or excessive — the organisation must still give reasons and cannot simply refuse.
- The data consists entirely of third-party personal data with no reference to you.
4 Common questions
Can an employer refuse a subject access request from a current employee?
No. Employees have the same rights as any other data subject under UK GDPR. An employer must provide all personal data it holds — including performance records, disciplinary notes, emails, and HR files. Some exemptions apply (for example, references the employer received in confidence), but the employer must tell you if it is withholding data and under which exemption. See the <a href="https://ico.org.uk/your-data-matters/employment/" target="_blank" rel="noopener noreferrer">ICO's employment guidance</a> for details.
How long does the organisation have to keep my data after I ask for it?
A SAR does not trigger a legal duty to retain data longer than the organisation's normal retention schedule. However, if you have or expect to have a legal claim, the organisation has a duty not to destroy relevant data once litigation is reasonably anticipated — this is called a litigation hold. The <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/" target="_blank" rel="noopener noreferrer">ICO's right of access guide</a> explains data retention in more detail.
What can I do if the data held about me is wrong?
Under Article 16 of UK GDPR you have the separate right to rectification — the right to have inaccurate personal data corrected without undue delay. Send a separate written request to the data controller specifying what is wrong and what the correct information is. If the organisation refuses, you can complain to the <a href="https://ico.org.uk/make-a-complaint/" target="_blank" rel="noopener noreferrer">ICO</a> or apply to court under section 167 of the <a href="https://www.legislation.gov.uk/ukpga/2018/12/section/167" target="_blank" rel="noopener noreferrer">Data Protection Act 2018</a>.
Sources