Why should I send a subject access request?
You should send a subject access request to find out everything an organisation knows about you, and what they're doing with it. When you know what companies have recorded about you and are using, you can take action, like telling them to delete it if you want to.
Unfortunately, too many companies:
- Collect your data without full consent
- Share or sell your information with third parties
- Don’t monitor what these third parties do with it
This can lead to material impacts on your life, like insurance or mortgage brokers making decisions about you using your personal data.
Sending a subject access request can help you make your data work for you.
- see what information companies have stored about you
- understand why certain decisions were made about you
- make sure that your data is being handled properly
By sending a request through Rightly, you can ask as many companies as you like what they know about you. We connect you, and they take it from there.
A Subject Access Request, or ‘SAR’ is a written request that you send to a company asking to see your personal data.
What might a company know about me?
Well, there are many types of personal data, but here are some that are commonly held:
- Name, address and contact details
- Bank and insurance details
- IP Address & Cookie identifiers
- Marital status and number of children
- Political opinions and affiliations
How do I send a subject access request (SAR)?
The easiest way to find out where your information is by sending a request through Rightly.
- Search for any company in the search bar above
- Enter your basic details so that they can confirm your identity
- Check your email and send your request
Here's what you can expect after you send your request:
Your request simply connects you to all of the companies you select, they’ll take it from there and link you to their own forms and processes for you to fill out. Only your name and email address is required to send these requests, but companies will likely ask you for much more information to identify you, like your ID.
They should confirm what personal information of yours they have within 30 days.
So I don't need a subject access request template?
Not at all. We've found that templates tend to vary in quality and also that it take a huge amount of time finding the right person to send it to, being caught in a back and forth verifying all of your documents with them and so on. That's why we made Rightly, to make it as safe and time-effective as possible for you to have more control over your data.
How long until a company responds to my request?
After the company has received your request, they have to reply in full within 30 days, or give a valid reason for asking for an extension. However, we're glad to say that most companies normally reply within a week.
Your responses from companies are likely to come directly into your inbox. We don't mind when this happens, as long as you're happy with how your request has been handled and have everything you need.
If you have any questions, or have any difficulty at all with how companies respond, our friendly support team is here to help!
What if they don't reply?
Don't worry. They have to reply by law. You can ask any company if they have your personal data, even if you don't know for sure whether or not they have it. They have to tell you what they have, as well as how and why they are using it. This is thanks to your ‘right of access’ under GDPR law. GDPR applies in the UK and EU.
How long can a company store my data for?
There is no specific time limit on how long a company can hold your personal data for. Following the GDPR, your information should simply not be kept for any longer than necessary.
While a company should be able to justify the length of time that your data is stored, whether or not this is acceptable depends on what the data was collected for in the first place.
For instance, a company can keep hold of employment contract data for a total of 6 years since this is the window of time in which a contract breach claim could be made.
However, when it comes to job applicant CVs for example, these can only be stored for a maximum of 6 months seeing as this is the length of time in which a candidate could file a discrimination claim.
We’re free because our mission is to make data fairer, for everyone.
We don't use consumer data for commercial purposes, which means we'll never, ever sell your data. It also means that there are no adverts or hidden costs.
Send your request in under two minutes
It's simple and completely free