A Subject Access Request (SAR) is your legal right under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It allows you to ask any organisation what personal data they hold about you, why they hold it, and who they have shared it with.
Organisations must respond to your request within one calendar month of receiving it. This right applies to any company, charity, or public body operating in the UK.
Sign up for a free SARTastic account and complete your profile with your name and address. These details are used to personalise your SAR letters and are stored securely.
Use our search to find the company or organisation you want to request data from. Our database contains over 600,000 organisations registered with the Information Commissioner's Office (ICO).
SARTastic generates a professionally drafted, legally compliant SAR letter addressed to the organisation. You can review and customise the letter before sending it.
Download or print your letter and send it to the organisation. You can send it by post or email. Mark it as sent in your dashboard to start tracking the deadline.
Your dashboard tracks the 30-day response deadline. If the organisation does not respond in time, SARTastic helps you understand your options, including escalating to the ICO.
Once your SAR has been received, the organisation has one calendar month to respond. They must provide:
The organisation cannot charge a fee for responding to a standard SAR. If they fail to respond within the deadline, you have the right to complain to the ICO.