A subject access request is one of the few data protection rights you can use without a solicitor, a form or a fee. You ask for the personal data an organisation holds about you, and it has to answer. Yet plenty of requests stall, get pushed back, or come home with almost nothing in them. Usually there's no conspiracy behind it. The request was worded in a way that let the organisation treat it as something else, and that is a fixable problem.

These are the five mistakes that cause the most trouble, and what to write instead.

Mistake one: it doesn't read like a request

You don't have to use the phrase "subject access request". A request made by email, over the phone, or even in a social media message can legally count. But organisations are big, staffed by people with wildly different levels of training, and a casual question like "any chance you can send me everything you've got on me?" lands in a general enquiries queue where it can sit for weeks.

The mistake isn't invalidity. It's invisibility. Say what you want in plain words and name the right you're relying on, so there's no room to file it under "miscellaneous".

I am making a subject access request under Article 15 of the UK GDPR. Please send me a copy of the personal data you hold about me.

Then add the date, ask for confirmation of receipt, and keep a copy of what you sent.

Mistake two: asking for everything, forever

"All information you hold about me, including every email, note, recording and internal document, from any time." It feels thorough. In practice it hands the organisation two arguments.

First, a good deal of that isn't personal data at all: internal policies, blank templates, training material, and anything that identifies somebody else. Second, an unlimited time frame makes the search enormous, which is exactly the justification an organisation needs to call a request excessive or to take the extra time the law allows for complex cases.

Narrow it yourself before they narrow it for you. Useful boundaries include:

• a date range, even a rough one
• the teams or systems likely to hold the data — customer services, complaints, billing, a named branch
• specific topics, such as a call, a complaint or an account closure
• the format that would help you most

A line like "please search customer service notes, complaint records and call recordings relating to account 12345 between 1 March 2023 and today" is far harder to park than a demand for everything.

One more thing: you don't have to explain why you want the data. A short sentence is plenty. Long explanations of your grievance tend to trigger a defensive response rather than a helpful one.

Mistake three: identification handled badly — by both sides

An organisation can ask you to prove you are who you say you are, and that's reasonable. Nobody wants their records posted to a stranger. The problems come at the extremes.

Send nothing and refuse to engage, and you've given them a legitimate reason to wait. Send far too much — a full passport scan, a selfie, your National Insurance number — and you've handed sensitive documents to a company that may not have asked for them and may not have a secure route for them either.

Match the proof to the account. Your full name, the address they hold, the account or reference number, the email address they already use for you, and often a recent utility bill, are usually enough for a consumer account. Check the organisation's privacy notice for the published request route and ask what's needed if it isn't clear.

If you're requesting on someone else's behalf, you'll need their written consent or evidence of your authority to act, such as a power of attorney. And if you're hoping to see what a call handler wrote about a third party, expect that to be redacted. Their data isn't yours.

Mistake four: sending it to the wrong place

Groups of companies, franchise networks, outsourced contact centres, and holding companies that own the brand but not the data all make this harder than it should be. Replying to a marketing email doesn't necessarily reach the entity that holds your records or the person responsible for responding.

Almost every organisation publishes a privacy notice, and it names the data protection contact or the address for rights requests. If there's no obvious route, aim for the data protection officer or the registered office. Keep evidence of when and where you sent it, ask for a reference number, and follow up if nothing comes back.

Sending it to the wrong individual inside the right organisation generally still counts as receipt. Proving that, though, is much easier when you can show exactly where your email went.

Mistake five: wrapping it in a complaint

A subject access request mixed into a long account of how badly you've been treated, a demand for compensation, and a warning about the Information Commissioner looks, to whoever opens it, like a complaint. That's where it gets routed, and the complaints team has a different set of instincts.

To be clear, an organisation cannot refuse a request simply because you're in a dispute with it or might use the data in a legal claim. That isn't a valid reason to refuse. But presentation shapes how quickly and generously you're answered.

Keep the two apart. One message, one purpose: the request asks for data. A separate email carries the complaint. Also remember that the right of access gives you personal data, not documents as such, so asking for "all files and correspondence" muddies an otherwise clean request. You might not receive everything in full either — exemptions can apply, for example where other people's information or legal professional privilege is involved — but you should be told what has been withheld and why.

How to phrase it so it can't be parked

1. Open with the right: "This is a subject access request under Article 15 of the UK GDPR."
2. Give your name and the details that match your account, plus a safe contact address.
3. Set the scope: date range, teams or systems, and topics.
4. Ask for the data itself, along with what it's used for, who it's shared with, how long it's kept and where it came from.
5. Ask for confirmation of receipt and a reference number.
6. Close with the deadline: "I look forward to your response within one month, as required by law."

Send it as a single, self-contained message. Don't bury the request in paragraph six of a longer letter, and don't rely on a phone call you can't evidence.

If they still stall or refuse

Responses are due within one month. If a request is genuinely complex or very large, that can be extended by up to two further months, and they should tell you within the first month that they're doing so. If they come back asking for identification, reply promptly, because in most cases the clock restarts when your ID lands.

If they refuse, ask for the reason in writing. Refusals usually rest on the request being manifestly unfounded or excessive, or on a specific exemption, and you're entitled to an explanation. You can raise it with the organisation's data protection officer first, then take it to the Information Commissioner's Office, which handles complaints about access requests.

And if the data is for a dispute that may end up in a tribunal or court, speak to a solicitor before you rely on it. This article is general guidance, not legal advice — a professional who knows your circumstances can tell you what a SAR will and won't give you.

Photo: Catkin / Pixabay