UK GDPR Article 15 · free to make · UK print and post
Post a subject access request with a dated dispatch record
Ask an organisation for your personal information in writing. If you choose to post your request, upload the prepared PDF and we arrange printing and postage from £1.79. Check the current response-time rules rather than counting from the posting date.
When you need a subject access request
A subject access request is a way to ask an organisation for your personal information. The ICO explains what to expect, including fees, identity checks, clarification and response times. Read its current guidance for making a request before relying on a deadline. A PostOwl status update is not proof of receipt by the organisation.
People most often send one when a dispute is brewing: a SAR letter to an employer before a grievance or tribunal claim, to a company as part of a complaint, or to a GP practice to request medical records by post. If the SAR is groundwork for a money claim, a letter before action is a separate step; check the appropriate process before making a claim.
What to put in the letter
There is no prescribed form. A plain letter works, and the ICO publishes a free subject access request template on ico.org.uk if you want a starting point. Address it to the organisation that holds your data (for GP records, the practice manager), not to the ICO. Whatever wording you use, cover the points below and keep a copy of your PDF.
SAR letter checklist
- Your full name, plus any previous names the organisation may know you by.
- Your current address, and any old addresses the data may be filed under.
- What data you want and the period it covers: “my personnel file and all emails mentioning me, January 2024 to date” beats “everything”.
- How you want to receive it: by post or by email.
- A clear request for your personal information. The label “subject access request” can help identify its purpose.
Organisations may ask you separately for proof of identity before responding. Never post original ID documents.
How PostOwl sends it
Save your request as a PDF and upload it at postowl.uk/send. Type the organisation’s address, choose first or second class, and pay by card or Apple Pay. No account needed. Check the current collection information before ordering. Production acceptance and postal handoff are separate stages. You get an email confirming the available order status. It does not establish when the response clock started. A one-page request costs £1.79 second class or £2.69 first class, and extra pages are £0.15 each, so a detailed request listing systems and date ranges stays cheap. Your PDF is permanently deleted after dispatch. Writing to the taxman instead? See our guide to posting a letter to HMRC.
Subject access request FAQs
Is a subject access request free?
Yes. Under UK GDPR the request itself is free of charge. An organisation can only charge a reasonable fee in limited cases: for example if a request is manifestly unfounded or excessive, or if you ask for further copies of data it has already given you. For a normal first request, there is nothing to pay the organisation.
How long does an organisation have to respond to a SAR?
The ICO says organisations normally have one month, with timing affected by necessary identity information, clarification and permitted extensions. A postal dispatch date does not establish when the response period starts. Check current ICO guidance for your situation.
Can I send a SAR by post instead of email?
You can make a subject access request by post or use another suitable contact method. The ICO also provides an email request tool. Keep a copy and any acknowledgement; post is not inherently stronger evidence than the organisation's online process.
How do I request my GP or NHS medical records?
A request for your medical records is a subject access request too. Write to your GP surgery addressed to the practice manager, say you are making a subject access request for a copy of your medical records, and state the period you want. For hospital records, write to the NHS trust that treated you. The request is free.
What should the SAR letter include?
Your full name (and any previous names the organisation may know you by), your address, exactly what data you want and the period it covers, how you want to receive it, and the words "subject access request". Keep a copy of the letter. If the organisation needs to verify who you are, it will ask you for proof of identity separately. Never post original ID documents.
Prepare your subject access request
Send it now from £1.79PostOwl is an independent printing and posting service and is not affiliated with the Information Commissioner’s Office. This page is general information, not legal advice.