Ask where they got your details.

1. What you can ask for

The ICO says you have the right to ask an organisation if it is using or storing your personal information, and to ask for copies of it. This is the right of access. Making the request is also called a subject access request, a SAR or a DSAR. Anyone can make one. The ICO says you don’t need a solicitor or a lawyer.

If the organisation has the information you asked for, the ICO says it should give you copies, unless there is a good reason not to. Its response should also include, among other things:

• what it is using your information for
• who it is sharing your information with
• how long it will store your information and why
• details about where it got your information from

That last point is the one that matters when you have never heard of the sender. In the legislation, Article 15 puts it this way: where the personal data were not collected from you, you have the right to “any available information as to their source”. The same article says you are only entitled to what the organisation is able to provide based on “a reasonable and proportionate search”. Those words set the limit of the right.

You will not necessarily get whole documents. The ICO says you can only get your own personal information that is in them, so parts may be removed or edited out.

2. Send the request

The ICO says you can usually find contact details for the people who deal with these requests in the organisation’s privacy notice or on its website. It lists these as the easiest ways to ask:

1. Online

   Many organisations let you submit a request through their website. The ICO says to take a screenshot of your request for your records before you press submit.

2. By email

   Write to the organisation directly, or use the ICO’s own SAR service. The ICO says the service creates an email to the organisation you specify, sends you a copy and takes about 10 minutes. You will need the organisation’s name and email address. It also says you should provide proof of ID and proof of address. The organisation replies to you directly, and the ICO does not see the reply.

The ICO says you can also make a request by post, over the phone or face to face. If you do, keep a record of when you made it and who you spoke to.

Its suggested contents include:

• a subject line or header that says “subject access request”
• the date you are making the request
• your name, email address, home address and phone number
• what personal information you want, as specifically as you can
• details or dates that will help the organisation find it
• how you would like to receive it, such as electronically or printed and sent by post

You do not have to give a reason. The ICO says being as specific as possible may help you get the fastest possible reply and more useful information back.

3. A request you can adapt

Use this with a real organisation you can identify. It asks only for things Article 15 lists. It is a starting point, not a substitute for advice about a dispute.

Subject: Subject access request

[Date]

I am making a subject access request under my right of access.

Please confirm whether you are processing personal data about me. If you are, please send me:

1. A copy of my personal data.
2. The purposes you are using it for.
3. Any available information about the source of the data, as it was not collected from me.
4. The recipients, or categories of recipient, it has been or will be disclosed to.

The details needed to identify my record are:
[Your name, and the email address, phone number or postal address you were contacted on]

Please send your reply by [email / post] to:
[Your contact details]

Keep a copy of what you send. The ICO recommends keeping emails or letters and any proof of postage or delivery.

4. How long it takes, what it costs and ID

• Time. The ICO says organisations normally have one month to reply.
• Extra time. If you have made a number of requests or your request is complex, they can take up to an extra two months. They must tell you within one month of getting your request and explain why.
• Unclear requests. If your request is unclear, the organisation may stop the clock until you explain what you are looking for. If it asks you for more information, the ICO says you must reply, even if only to say you are not providing it.
• Cost. Normally, organisations can’t charge. The ICO says they can charge a reasonable fee to cover administrative costs if they think a request is “manifestly unfounded or excessive”, or if you ask for further copies. If a fee is charged, the one-month limit does not begin until you have paid it.
• ID. The ICO says ID checks are sometimes needed, and that when asked for ID you should provide it. If they ask, the clock only starts when they have what they need from you.

The ICO says an organisation might ask for ID if it does not recognise your details, for example if you write from an email address that does not match the one in its records. So if they emailed you, it makes sense to write from the address they used.

5. Use the answer

1. Tell them to stop marketing to you

   The ICO says organisations cannot refuse if you object to them using your information for marketing targeted at you specifically. There is a letter for that in the data removal guide.

2. Ask the source the same question

   If the reply names another organisation as the source, you can send that organisation the same request. Knowing the source does not remove your details from it.

3. Chase a late reply

   If it has been over one month and you have heard nothing, the ICO says you should send a follow-up email or letter.

4. Complain to the organisation first

   If you are unhappy with the reply for any reason, the ICO says you should first complain to the organisation, by email where possible. If you think information is missing, clearly list what else you think it holds. Keep copies as evidence. The ICO’s page has a complaint letter template.

5. Then the ICO

   Once you have followed those steps, you can complain to the ICO. It says you should do so within three months of your last meaningful contact with the organisation. The ICO cannot act as your representative or award compensation. The complaints guide covers the routes.

Related guides

• Get off the lists behind the lists. Use official privacy routes to reduce how widely your contact details are shared.
• When they keep contacting you anyway. Who to complain to about marketing that carries on after you have said no, what to have ready and what happens afterwards.