[Your name]
[Your address]

[Date]

[Organisation name]
[Organisation address, or "Data Protection Officer" if address unknown]

Dear Data Protection Team,

Subject Access Request — Article 15 UK GDPR

I am writing to request a copy of the personal data you hold about me, in accordance with my right of access under Article 15 of the UK General Data Protection Regulation and the Data Protection Act 2018.

Please provide a copy of the following categories of data:

- [Category 1 — e.g. "account records"]
- [Category 2 — e.g. "correspondence"]
- [Category 3 — add or remove as needed]
- [Add further categories, or delete this list and write "all personal data you hold about me" if you would prefer everything]

[Optional — delete if not applicable] Please limit this to the period [start date] to [end date].

[Optional — delete if not applicable] [One or two sentences of brief context for your request, in your own words.]

Please confirm receipt of this request. Under UK GDPR you are required to respond within one calendar month of receipt. If you need to extend this period, please let me know the reason and revised timeframe as soon as possible.

If any of the requested data is not held, please confirm this explicitly rather than omitting it from your response.

If you are unable to fulfil this request in full or in part, please explain which exemption you are relying on.

Please provide this information in a searchable PDF format (rather than image scans) and by email or post, rather than via an online portal.

I am happy to provide proof of identity if required to verify this request.

Yours faithfully,

[Your name]
[Your email address — worth including even here, so the organisation can reply quickly, especially for identity verification]

---

This is a starting-point draft, not a finished legal document — please review and personalise it before sending. For UK requests only. Reflects UK GDPR guidance as of 26.08.2026.

This kind of request is normally free. An organisation can only charge, or refuse, if it considers the request "manifestly unfounded or excessive" — and even then, it must tell you this and confirm any fee before proceeding, not simply charge you. Making a further request later is not automatically treated this way if you have a genuine reason for it.

You don't need a specific address or department — this can be sent to any part of the organisation, which has a duty to recognise it and pass it on. If an organisation says it only accepts SARs via its own portal, a request made by email or post is still legally valid — though using the portal too may get a faster response in practice. Similarly, a portal-only reply from them isn't automatically non-compliant, since many portals count as an acceptable electronic format.

If you print this to post, remember to fill in today's date before sending — a posted letter has no automatic record of when it was sent, unlike an email, so a blank or missing date can make it harder to establish exactly when the one-month response clock started.