Ever wondered exactly what data a company holds about you? You have a full legal right to this information, and using a properly formatted Subject Access Request Sample Letter is the fastest way to get a compliant response.

Most people mess this up by sending vague emails that get ignored or delayed for weeks. This guide will walk you through exactly when and how to use these letters, with usable real-world examples for every common situation.

Why A Standardised Subject Access Request Sample Letter Works

Most people draft Subject Access Requests from scratch, and that is where problems start. Organisations receive hundreds of requests monthly, and unstructured messages get pushed to the bottom of processing queues.

Using a proven sample letter ensures you include every legally required detail, so teams can process your request without follow up delays.

A valid SAR must always include these core details:

  • Your full legal name and any previous names held by the organisation
  • Proof of identity reference such as customer number or registered email
  • Clear statement that this is a formal Subject Access Request
  • Date of the request to track legal response deadlines

Legal response times vary by region, but all valid requests trigger binding deadlines:

Region Legal Response Deadline
UK GDPR 1 Calendar Month
EU GDPR 1 Calendar Month
US CCPA 45 Calendar Days

Subject Access Request Sample Letter For General Personal Data

To: Data Protection Officer
[Company Name]
Data Protection Office Address

Dear Sir/Madam,

This is a formal Subject Access Request under applicable data protection law. I request copies of all personal data you hold about me, including contact records, transaction history, internal notes and data shared with third parties.

My account details: Jane Doe, Customer ID 1234567, Registered Email jane.doe@example.com

I can provide photo ID on request. Please confirm receipt within 3 working days.

Yours faithfully,
Jane Doe

Subject Access Request Sample Letter For Employment Records

To: HR Data Protection Lead
[Employer Name]

Dear HR Team,

This is a formal Subject Access Request for all personal data held relating to my employment. This includes performance notes, disciplinary records, internal communications, payroll data and exit interview records.

My employee number is EMP-9876. I worked at the company from 01/03/2020 to 15/10/2024.

Please send all records to my personal email address listed on this request.

Regards,
John Smith

Subject Access Request Sample Letter For Police Records

To: Data Access Unit
Local Police Force

Dear Records Team,

This is a Subject Access Request for all personal data and police records held under my name. This includes incident reports, stop and search records, custody notes and any intelligence entries logged against me.

I have attached a scanned copy of my driving license for identity verification. Please process this request within the legal time limit.

Yours sincerely,
Sarah Lee

Subject Access Request Sample Letter For Credit Reference Agency Data

To: Data Protection Department
[Credit Reference Agency Name]

Dear Team,

I am submitting a Subject Access Request for the full copy of my credit file, all search history, internal notes, and records of third parties who accessed my data in the last 24 months.

My full name, date of birth and 5 year address history are listed below this message. Please send all records as a machine readable PDF file.

Regards,
Mike Carter

Subject Access Request Sample Letter For Social Media Account Data

To: Platform Data Protection Team

Dear Support,

This is a formal Subject Access Request for all data associated with my user account. This includes private messages, post history, location logs, ad targeting profiles, and deleted content retained by the platform.

My account username is @username123. I request all data be provided in standard export format.

Thank you,
Amy Wong

Subject Access Request Sample Letter For Medical Health Records

To: Medical Records Manager
[GP Surgery / Hospital]

Dear Records Manager,

This is a Subject Access Request for my full medical record. This includes consultation notes, test results, referral letters, medication history, and any internal communications relating to my care.

I confirm I give full consent to release all of my health records. I will collect physical copies on the 20th of next month.

Yours sincerely,
Robert Hughes

Subject Access Request Sample Letter Following A Complaint

To: Data Protection Officer

Dear DPO,

Following my customer complaint dated 12th November, I am submitting this Subject Access Request for all communications, internal notes, call recordings and case logs relating to my complaint and customer account.

This request is made under data protection law. All requested records must be provided before any further discussion regarding my complaint.

Regards,
Lisa Palmer

Frequently Asked Questions about Subject Access Request Sample Letter

Do I need to use an official template to make a SAR?

No official template is required by law. However, using a standard Subject Access Request Sample Letter ensures you include all required details and avoid unnecessary delays. Most organisations will not reject correctly formatted sample letters.

Can companies charge me for responding to a SAR?

In almost all cases, organisations cannot charge for a standard subject access request. They may only charge for excessive, repetitive or manifestly unfounded requests. You will be notified if any charge applies before processing begins.

What happens if a company ignores my request?

If an organisation misses the legal response deadline, you can report them to your national data protection regulator. Regulators have the power to issue fines and order the company to comply with your request.

Can I send a SAR via email?

Yes, you can send a subject access request by email, post or secure message. Always keep a copy of the message and delivery confirmation for your records. Sending via recorded delivery is recommended for high priority requests.

Do I have to explain why I am making the request?

You do not need to give any reason for making a subject access request. The organisation may only ask for details needed to confirm your identity and locate your records.

What information can I request with a SAR?

You can request all personal data an organisation holds about you. This includes notes, recordings, emails, internal documents, and data shared with other parties. There are only very limited legal exceptions to this right.

Can I request data about other people?

You can only request personal data about yourself. You may request data on behalf of another person only if you have legal authority such as power of attorney or parental responsibility for a child.

How far back can I request records?

There is no legal time limit on how far back you can request records. Organisations only need to provide data they still hold and retain under their approved data retention policies.

Can a company refuse my subject access request?

Organisations can only refuse a request for very specific legal reasons, such as protecting other people's rights. They must provide you with a full written explanation if they refuse any part of your request.

Using a properly structured Subject Access Request Sample Letter removes the guesswork from exercising your data rights. Every template on this page follows legal requirements, works across all major regions, and will get you a response much faster than writing a request from scratch. You can adapt any of the examples above for your exact situation in just 2 minutes.

Save this page for future reference, and always keep a copy of every request you send. Next time you want to know what data an organisation holds, don't guess at what to write. Use one of these tested sample letters and get the full response you are legally entitled to.