Your Data. Your Property.

A DSAR is a powerful legal right guaranteed under Article 15 of the UK GDPR. It forces any organisation to give you a copy of the personal data they hold about you. This is not a request for a favour. It is a demand for your property. It includes emails, HR files, call recordings, and internal notes.

They have one calendar month from the day they receive your request. For example, if they receive it on 3rd September, they must reply by 3rd October.

Warning: If they ask for your ID to verify who you are, the clock "pauses" until you send it. This is their favourite delay tactic. We recommend attaching your ID immediately to stop this from happening.

Rarely. They can only refuse if your request is "manifestly unfounded or excessive". This is a very high legal bar. They cannot refuse just because your request is annoying, expensive, or difficult for them to process. Our tool helps you write a specific, reasonable request that is very hard to refuse.

It is free. In the past, companies could charge £10, but the GDPR banned this fee. They can only charge a fee if you ask for "further copies" of data you already have, or if your request is clearly excessive.

Yes. If your name, initials, or a nickname is used in a Slack channel, Microsoft Teams chat, or internal email chain, that is your personal data.

Strategy: Don't just ask for "all emails". Be specific. Ask for: "Internal messages between [Manager Name] and [HR Name] between [Date] and [Date]."

Absolutely. This is the most common reason for a DSAR. You have a right to see the minutes of meetings, the "pre-meeting" notes HR made, and any emails discussing your performance or dismissal. This evidence is often critical if you are taking a case to an Employment Tribunal.

Yes. You are entitled to see formal appraisals and informal notes managers have kept about you on their local drives or notebooks, provided those notes are stored in a filing system.

Yes. If you have been denied a bank account or credit without a clear reason, you can ask for "CIFAS Markers" or "Internal Fraud Flags". A DSAR forces them to reveal the data behind the decision.

Companies sometimes use this excuse to extend the deadline by two extra months (giving them three months total).

Your Move: If they say this, reply immediately and ask them to explain exactly why it is complex. Often, they will back down when challenged.

Yes. If a company tells you "this call is recorded for training and monitoring purposes", that recording contains your personal data. You can demand a copy of the audio file or a full transcript.

This is known as "Data Dumping". They hope you will be overwhelmed and give up. You do not have to read it all. We are building tools to help you scan these documents for keywords like "redundancy", "risk", or "difficult".

Sometimes. They are allowed to redact:

Third Party Data: Information about other people (like a colleague's private email address).

Legal Privilege: Confidential advice they received from their lawyers.

The Limit: They cannot redact their own internal embarrassment. If a manager was rude about you in an email, you have a right to see that.

No. A request is valid if it is sent by email, letter, or even social media. You do not have to fill out their complex portal or specific forms, although it can sometimes speed things up. Our PDF generator creates a valid legal notice that they must accept.

Companies have a legal duty to protect data. They must ensure they are sending the file to the real you, not an impostor.

Our Advice: Don't fight it. Send a photo of your driving licence or passport with the edges crossed out, or watermarked "For DSAR Only". If you refuse, they can legally ignore your request.