UK GDPR Article 15 · free to make · same-day dispatch
Post a subject access request with a dated dispatch record
An organisation has one calendar month to answer a subject access request letter, and the clock starts when it receives it. Upload your PDF and we print and post it from £1.79, with an email confirming the date it went to Royal Mail.
When you need a subject access request
Article 15 of the UK GDPR gives you the right to a copy of the personal data any organisation holds about you: your employer, your bank, an ex-landlord, your GP practice or NHS trust, the police. The request is free, and the organisation must respond within one calendar month. The ICO explicitly supports making the request by post, and advises keeping a record of when you made it, which is exactly what a posted letter with a dated dispatch email gives you.
People most often send one when a dispute is brewing: a SAR letter to an employer before a grievance or tribunal claim, to a company as part of a complaint, or to a GP practice to request medical records by post. If the SAR is groundwork for a money claim, a letter before action is usually the next letter you send.
What to put in the letter
There is no prescribed form. A plain letter works, and the ICO publishes a free subject access request template on ico.org.uk if you want a starting point. Address it to the organisation that holds your data (for GP records, the practice manager), not to the ICO. Whatever wording you use, cover the points below and keep a copy of your PDF.
SAR letter checklist
- Your full name, plus any previous names the organisation may know you by.
- Your current address, and any old addresses the data may be filed under.
- What data you want and the period it covers: “my personnel file and all emails mentioning me, January 2024 to date” beats “everything”.
- How you want to receive it: by post or by email.
- The words “subject access request”, so it gets logged and routed correctly.
Organisations may ask you separately for proof of identity before responding. Never post original ID documents.
How PostOwl sends it
Save your request as a PDF and upload it at postowl.org/send. Type the organisation’s address, choose first or second class, and pay by card or Apple Pay. No account needed. Order before the 3pm weekday cutoff and it is printed, enveloped and handed to Royal Mail the same day. You get an email confirming the dispatch date: your evidence of when the one-month clock started. A one-page request costs £1.79 second class or £2.69 first class, and extra pages are £0.15 each, so a detailed request listing systems and date ranges stays cheap. Your PDF is permanently deleted after dispatch. Writing to the taxman instead? See our guide to posting a letter to HMRC.
Subject access request FAQs
Is a subject access request free?+
Yes. Under UK GDPR the request itself is free of charge. An organisation can only charge a reasonable fee in limited cases: for example if a request is manifestly unfounded or excessive, or if you ask for further copies of data it has already given you. For a normal first request, there is nothing to pay the organisation.
How long does an organisation have to respond to a SAR?+
One calendar month from the day it receives your request. If the request is complex, or you have sent several requests, it can extend the time to respond by a further two months, but it must tell you within the first month and explain why. This is exactly why a dated record of when you posted the request is worth having.
Can I send a SAR by post instead of email?+
Yes. A subject access request is valid in any written form, and the ICO explicitly supports making one by post. It also advises keeping a record of when you made the request. A posted letter creates a dated paper trail that HR departments and data protection teams log on arrival, which makes it much harder for the request to sit unanswered in a shared inbox.
How do I request my GP or NHS medical records?+
A request for your medical records is a subject access request too. Write to your GP surgery addressed to the practice manager, say you are making a subject access request for a copy of your medical records, and state the period you want. For hospital records, write to the NHS trust that treated you. The request is free.
What should the SAR letter include?+
Your full name (and any previous names the organisation may know you by), your address, exactly what data you want and the period it covers, how you want to receive it, and the words "subject access request". Keep a copy of the letter. If the organisation needs to verify who you are, it will ask you for proof of identity separately. Never post original ID documents.
Start the clock today
Send it now → from £1.79PostOwl is an independent printing and posting service and is not affiliated with the Information Commissioner’s Office. This page is general information, not legal advice.