Why should I send a subject access request?
You should send a subject access request to find out everything an organisation knows about you, and what they're doing with it.
Unfortunately, too many companies:
- Collect your data without full consent
- Share or sell your information with third parties
- Don’t monitor what these third parties do with it
This can lead to material impacts on your life, like insurance or mortgage brokers making decisions about you using your personal data.
Sending a subject access request can help you make your data work for you.
- see what information companies have stored about you
- understand why certain decisions were made about you
- make sure that your data is being handled properly
When you know what companies have recorded about you and are using, you can take action, like telling them to delete it if you want to.
A Subject Access Request, or ‘SAR’ is a written request that you send to a company asking to see your personal data.
What might a company know about me?
Well, there are many types of personal data, but here are some that are commonly held:
- Name, address and contact details
- Bank and insurance details
- IP Address & Cookie identifiers
- Marital status and number of children
- Political opinions and affiliations
How do I send a subject access request (SAR)?
The easiest way to find out where your information is by sending a request through Rightly.
- Search for any company in the search bar above
- Enter your basic details so that they can confirm your identity
- Check your email and send your request
So I don't need a subject access request template?
Not at all. We've found that templates tend to vary in quality and also that it take a huge amount of time finding the right person to send it to, being caught in a back and forth verifying all of your documents with them and so on. That's why we made Rightly, to make it as safe and time-effective as possible for you to have more control over your data.
How long until a company responds to my request?
After the company has received your request, they have to reply in full within 30 days, or give a valid reason for asking for an extension. If this happens, our support team is here to help!
What if they don't reply?
Don't worry. They have to reply by law. You can ask any company if they have your personal data, even if you don't know for sure whether or not they have it. They have to tell you what they have, as well as how and why they are using it. This is thanks to your ‘right of access’ under GDPR law. GDPR applies in the UK and EU.
How long can a company store my data for?
There is no specific time limit on how long a company can hold your personal data for. Following the GDPR, your information should simply not be kept for any longer than necessary.
While a company should be able to justify the length of time that your data is stored, whether or not this is acceptable depends on what the data was collected for in the first place.
For instance, a company can keep hold of employment contract data for a total of 6 years since this is the window of time in which a contract breach claim could be made.
However, when it comes to job applicant CVs for example, these can only be stored for a maximum of 6 months seeing as this is the length of time in which a candidate could file a discrimination claim.
We’re free because our mission is to make data fairer, for everyone.
We don't use consumer data for commercial purposes, which means we'll never, ever sell your data. It also means that there are no adverts or hidden costs.
Send your request in under two minutes
It's simple and completely free