What is a Subject Access Request

A subject access request (SAR) is a legal mechanism that empowers individuals to gain access to their personal data held by organizations, pursuant to data protection regulations. Specifically, under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, individuals have the right to request access to any personal data that an organization holds about them, subject to certain exemptions and conditions. To make a valid SAR, individuals are required to provide their name and contact information, as well as details that can help identify the personal data sought. Upon receiving a SAR, organisations are obligated to respond within a month and provide a copy of the requested personal data, along with any additional information required by law. While there are limitations to the scope of personal data that SARs apply to, and exceptions that allow organisations to refuse or restrict access, they nevertheless represent a powerful tool for individuals seeking to exercise greater control over their personal information in the digital age.

Why Make a Subject Access Request

There are several reasons why you may want to make a subject access request (SAR). Firstly, SARs allow you to understand and review the personal data that organizations hold about you. This can help you to identify any inaccuracies or errors in your personal data, and can also help you to understand how your data is being used and processed by different organizations.

SARs can help you to exercise your rights under data protection laws. By making a SAR, you are asserting your right to access your personal data, which can be an important step in protecting your privacy and controlling how your personal information is being used.

SARs can help you to address any concerns or issues you may have with how an organization is handling your personal data. For example, if you suspect that an organization has processed your personal data unlawfully or without your consent, making a SAR can help you to gather evidence to support your claim.

Overall, making a SAR can be an important tool for individuals seeking to better understand, control, and protect their personal data in an increasingly data-driven world.

How Do I make a Subject Access Request

Making a subject access request (SAR) is a straightforward process that involves a few key steps. Firstly, you will need to identify the organization or organizations that hold your personal data, and determine the appropriate contact person or department for making a SAR. You may be able to find this information on the organization’s website or privacy policy.

Once you have identified the appropriate contact person or department, you should prepare your SAR by providing your name and contact information, as well as any relevant details that can help the organization identify the personal data you are requesting. It can be helpful to be as specific as possible in your request, and to include any relevant dates, locations, or other details that can help narrow down the scope of your request.

After preparing your SAR, you should submit it to the appropriate contact person or department, either by email, post, or through an online form if available. It is a good idea to keep a copy of your SAR, as well as any correspondence or responses you receive from the organization.

Once the organization receives your SAR, they are obligated to respond within a month and provide you with a copy of your personal data, as well as any additional information required by law. If you have any questions or concerns about the organization’s response, you may wish to seek legal advice or contact your local data protection authority for further guidance.

Subject Access Request Sample Letter Relating to Debt

RECORDED DELIVERY

FOR THE ATTENTION OF THE DATA PROTECTION/COMPLIANCE OFFICER
Dear Sirs,

Under the provision of the Subject Access Rights granted to me/us by the Data Protection Act, I/we would be grateful if you would forward details of the relevant information relating to my/our account and that fall within the terms of the Act, as listed below and further highlighted in the attached covering letter.

Request for information under the Data Protection Act 1998 should be responded to within 40 days.
I/we ask that you provide the following:-

1. A copy of the Original Signed Credit Agreement
2. A copy of the Deed of Assignment
3. Account transaction history and interest rates (APR)
4. A copy of the application form including broker/packager documentation
5. A copy of the Terms and Conditions relating to the account
6. A copy of all correspondence relating to this account
7. Metadata of the computer which that document was created
8. Any other information or data held on the applicant(s) digital or otherwise

I/we understand that a fee not to exceed £10.00 (also see below) may be charged for this information and enclose a cheque by way of payment for this amount, along with evidence of our address.
Signed and Dated

How Much is a Subject Access Request

The cost of making a subject access request (SAR) can vary depending on the organization and the amount of personal data being requested, with some organizations charging a fee to cover the administrative costs of processing the request, while others may provide the information free of charge.

According to the Information Commissioner’s Office (ICO): While in most cases organizations cannot charge a fee to comply with a subject access request (SAR), a “reasonable fee” may be charged in certain circumstances. This fee may cover the administrative costs of complying with the request if it is deemed manifestly unfounded or excessive, or if the individual makes repeated requests for further copies of their data.

I have never known the fee to exceed £10.

How Long Should a Subject Access Request Take

Normally, you should have a response to your Subject Access Request within one month. Organizations are allowed to extend the one-month time limit for responding to a (SAR) by an additional two months if the request is complex, or if they have received a large number of requests from the same individual.

Letter of Authorisation

If you are looking for a letter of authorisation for someone to act on behalf of you, you will find that here; Debt Letter of Authorisation (LoA)