Subject access requests: getting your records, emails and CCTV

Any organisation in the UK that holds information about you must give you a copy of it on request — free of charge, and normally within one month. This is a subject access request. It covers health records, credit reference files, an employer's correspondence with your name in it, CCTV footage of you, and much else.

Who do you write to?

If the organisation is a public one, write to its Data Protection Officer. The DPO's details should be in the organisation's privacy notice on its website. If there is no DPO, or you do not know who to write to, address your letter to the company secretary. There is no prescribed form: a letter or an email asking for a copy of the information held about you is enough.

ADV · A003We build websites for tradespeople and sole traders — £219Customers see your work and prices and message you straight away. Ready in 3 days, £219 instead of £438.Advertise here

How long should it take?

The organisation must give you the data as soon as possible, and within one month at most. In certain circumstances — particularly complex or multiple requests — it can take a further two months, but it must tell you within one month of your request that there is a delay and why. Silence for a month followed by a claim of extension is not the lawful order: the notification has to arrive inside the first month.

What does it cost?

Usually nothing. An organisation can charge an administrative cost in some circumstances, for example if you are asking for a large amount of information, or if your request will take a lot of time and effort to process. That is the exception; free is the default.

What can be withheld?

The law allows information to be withheld in several situations: where it concerns the prevention, detection or investigation of a crime; national security or the armed forces; the assessment or collection of tax; or judicial or ministerial appointments. One detail is easy to miss — an organisation does not have to tell you why it is withholding information.

How do you get your health records?

Through the NHS App, which is the quickest route if you are registered with a GP in England. The app has sections for test results, vaccinations, health conditions and allergies, and documents such as GP surgery letters, which can be opened and downloaded. If what you need is not in the app, or the records are older, make the request to the GP practice itself or to the hospital that treated you — as an ordinary subject access request, with the same one-month deadline.

How does this differ from an FOI request?

By subject matter. A Freedom of Information request is about information a public authority holds generally — statistics, correspondence, decisions — and the response time is 20 working days. A subject access request is about information held about you, can be made to any organisation including private ones, and the deadline is one month. If you send an FOI request for your own data, the authority will handle it under the right regime, but you lose time.

What if you get no answer, or a partial one?

Complain to the organisation first — that is the required opening step. If the response does not satisfy you, or none arrives, go to the Information Commissioner's Office, the UK's data protection regulator. The ICO's number is 0303 123 1113, Welsh language 0330 414 6421, textphone 01625 532692, Monday to Friday 9am to 5pm.

What is this actually used for?

Most often, gathering evidence. People ask what an employer holds about them before an employment dispute; for health records before a complaint about treatment; for correspondence and call recordings in a dispute with a bank or insurer; for a credit reference file after being refused credit. Build the one-month deadline into your planning: if you are working to a procedural time limit, send the request at the start rather than in the final week.

Can you ask for CCTV footage of yourself?

Yes — footage showing you is your personal data, and the same rules apply: a written request, one month to respond, free by default. One practical caveat: CCTV is usually kept for a short time, often days or weeks, so speed matters here more than with any other kind of request about yourself.