📖 What is a SAR and why should I use one?

Show ▾

🔍 What is a Subject Access Request?

A SAR is your legal right under UK GDPR to ask any organisation what personal data they hold about you — and receive a copy. Every company, government body, NHS trust, or data broker must comply within 30 days, free of charge.

🤔 Why would I want to do this?

To see what your bank holds about you, check what data your insurer used to calculate your premium, find out if a data broker is selling your profile, access your medical records, or request CCTV footage you appear in. It's your data — you have the right to see it.

💡 Real examples of what people discover through SARs

A supermarket loyalty card SAR revealed purchase history going back 11 years, including inferred health and lifestyle scores used for targeted marketing

An insurer held an internal risk flag that had incorrectly inflated a customer's premiums for 3 years — discovered only through a SAR

A data broker held a profile including estimated income, political leanings, and a neighbourhood risk score — built entirely without the person's knowledge

TfL's SAR response revealed a complete Oyster journey history spanning 7 years — every bus, tube and rail trip taken in London

A credit reference agency held a County Court Judgment that didn't belong to the individual — discovered through a SAR and successfully challenged

Your legal right under UK GDPR Article 15: Organisations must respond within 30 calendar days. They cannot refuse unless a request is manifestly unfounded or excessive, and cannot charge a fee. If they fail, report them to the ICO at ico.org.uk — free of charge.

⚠️ Maximum 3 submissions per day reached. Please try again tomorrow.

Personal information

Full legal name *

Date of birth *

Select date of birth ▼

Current address *

Email address * Please enter a valid email address

Phone number Please enter a valid UK phone number

Account / reference number

Your bank account number, loyalty card number, customer ID, or any reference the organisation uses for you. Speeds up processing and reduces delays from identity checks.

Previous names

Previous addresses

Receive copies of your SARs

Email me copies

Copy to (if different email)

* required

ℹ️

Select up to 5 organisations per submission. Each should be one you have (or have had) a real relationship with. You'll set the data scope for each individually in Step 3.

⚠️ Please complete the following before sending

Preview — click any letter to expand

Delivery

${getIcon('✉️',22)||'✉️'}

Send automatically

Auto-send orgs emailed directly. Guided orgs get step-by-step instructions with form links.

${getIcon('📁',22)||'📄'}

Download copies

Download a .txt copy of each SAR letter for your records

⚖️ Not legal advice. easySAR generates SAR letters based on the information you provide. We are not solicitors and this tool does not constitute legal advice. For complex data rights matters, consult a qualified lawyer or contact the ICO directly.

✓

SARs submitted

Your Subject Access Requests have been sent. Organisations have 30 days to respond under UK GDPR.

⏱️ 30-day deadline: Organisations must respond within one calendar month. Make a note of today's date.

❌ No response or unsatisfied? You can escalate free of charge to the Information Commissioner's Office:
→ Make a complaint to the ICO

🧬 Biometric / facial recognition data? If your SAR relates to biometric or facial recognition data and you believe it was processed unlawfully, you can report this directly to the ICO:
→ Report to the ICO

Confirm before sending

easySAR