Subject Access Requests (SAR)

Your statutory right

Article 15 of the UK General Data Protection Regulation (UK GDPR) gives every data subject the right to obtain confirmation of whether their personal data is being processed, and if so, to access that data. Article 15(3) entitles you to a copy of the data — not just a summary.

The Data Protection Act 2018 implements the same rights in domestic law and gives the Information Commissioner's Office (ICO) the power to enforce them.

What you can ask for

In a debt-collection context, a well-drafted SAR should specifically request:

• A copy of the original executed credit agreement.
• The complete chain of assignment — every Deed of Assignment and Notice of Assignment from the original creditor through to the current claimant.
• A full payment and transaction history.
• All communications sent to or received from you (letters, emails, call logs, texts).
• All internal notes and records relating to the account.
• Details of any credit reference agency entries made or amended.
• The names and roles of any third parties to whom the data has been disclosed.
• The source of any data not collected from you directly.
• The legitimate-interest balancing assessment relied on to justify processing your data.

The mechanics

• Send the request in writing — by Royal Mail Signed For, so you have proof of delivery.
• Address it to the Data Protection Officer or Compliance Team of the agency.
• There is no fee for a SAR. Article 12(5) UK GDPR.
• The agency has one calendar month from receipt to respond. They may extend by up to two further months for complex requests, but only if they tell you within the first month with reasons.
• Don't volunteer ID documents. They can ask for specific verification if they have reasonable doubt about your identity — but only then. Volunteering ID concedes leverage.

What happens when they fail to comply

Failure to comply with a SAR within the statutory period entitles you to:

• Complain to the ICO under section 165 DPA 2018 and Article 77 UK GDPR. The ICO can issue Information Notices, Enforcement Notices, and monetary penalties.
• Apply to the court for a compliance order under section 167 DPA 2018, and claim compensation under Article 82 UK GDPR.
• Use the failure as evidence in any later dispute — including a defence to a claim — that the agency cannot prove its case.

Why the SAR matters even before any court action

Many debt buyers — especially those chasing old debts that have changed hands several times — do not actually hold the original credit agreement. They hold a name, address, balance, and a date. A SAR exposes this. If they cannot produce the agreement, your subsequent letters (or any later defence) can directly cite that failure.

Combined with a section 77/78 CCA request, the SAR triggers two parallel disclosure obligations that together cover almost every relevant document the creditor would ever need to produce at trial.

Read the law and the ICO's guidance

The relevant texts are on the legislation site and at the ICO: UK GDPR Article 15 , ICO consumer guidance