How to make a subject access request

Field 01A subject access request is a copy, not a conversation

A subject access request is a demand for a copy of the personal data an operator holds about you, plus the information that makes it intelligible: the purposes, the categories, the recipients, the retention period and the source. It is not a customer-service enquiry and not a favour — under the general model it is a right with a deadline. You do not need a reason, a form or a template, and in most regimes the first request is free. The reply must give you the data itself in an intelligible form, with any internal codes or abbreviations explained, not a summary that paraphrases it.

Field 02How to ask so that the request is easy to enforce

The version of a request that a regulator can act on is the version with evidence behind it. Send it in writing, from the email address on the account, to the data-protection contact the privacy notice names — or to the operator’s ordinary support address if no contact is stated. Say clearly that it is a subject access request, name the data you want (all of it, or the categories you care about), give the account reference, and date it. Keep a copy. That record is what establishes the deadline started, and it is the thing you will be asked for if the response is late.

• In writing, from the account email It anchors the request to the account and gives you a copy of what was sent.
• Name it as a subject access request The label matters; a vague enquiry can be handled as ordinary support.
• Ask for the data and the details Purposes, categories, recipients, retention and source — plus the fields themselves.
• Date it and keep it The day you asked is the day the clock starts once identity is confirmed.
• Ask for the format A structured export (CSV/JSON) is easier to check than a PDF of screenshots.

Field 03What the reply must contain

A complete response has two halves. The first is a copy of the personal data held — the fields and their values, with any codes expanded so the document is intelligible. The second is the surrounding information: the purposes of processing, the categories of data, the recipients or categories of recipient, the retention period or the criteria that set it, the source of the data where it was not collected from you, and the existence of the other rights. Where data about you is interwoven with data about someone else, the operator may redact the other person’s part — but not by withholding yours.

Field 04The clock, and the one extension it allows

Under the general model — the EU and UK GDPR being the codification most others mirror — the operator must respond without undue delay and within one month. Two things move the clock. First, it does not start until the operator can confirm who is asking, which is why prompt identity confirmation is the practical way to keep the month short and why a slow identity check can feel like a silent refusal. Second, the operator may extend by up to two further months where the request is genuinely complex or you have made several; if it does, it must tell you within the first month and give its reasons.

Field 05Fees, and the refusals that are (and are not) allowed

A first request is normally free. An operator may charge a reasonable fee, or refuse, only in defined situations — a request that is manifestly unfounded or excessive, or a further copy you have asked for — and it should tell you which ground it is relying on. It may also refuse part of a request where an exemption applies: data about another person, data protected by legal privilege, or data whose disclosure would undermine a crime-prevention duty. What is not allowed is a blanket refusal with no ground, silence past the deadline, or a reply that answers a request you did not make.

Field 06When the reply is late, partial or refuses with no ground

Escalation is a sequence. First, chase in writing and ask for the specific ground for any refusal; an operator that has a ground will usually name it once asked, and one that does not may simply answer. Second, if the response remains inadequate, complain to the operator’s data-protection officer formally. Third, complain to the data-protection authority in the country where you live, which can investigate and, in many regimes, order a response. The record you kept — the request, the dates and the reply — is what the authority will ask for. A gambling-specific dispute about a bet is a different route, and belongs with the operator’s regulator rather than the data-protection authority.