Subject access request templates

Dear [name],

Your request for your personal information

Thank you for your request, which we received on [date]. We are handling it as a subject access request under the UK GDPR. Our reference is [reference].

We will respond by [deadline]. If we need anything else from you to deal with your request, we will contact you as soon as possible.

If you have any questions, please contact [team] at [contact details], quoting your reference.

Yours sincerely,
[name, role]

Dear [name],

Your request for your personal information, reference [reference]

Thank you for your request, which we received on [date]. Before we can send you personal information, we need to be sure we are sending it to the right person.

Please send us [one specific item, for example a copy of a recent letter we sent to you / a signed authority from your client].

We will start work on your request as soon as we receive this, and we will respond within one month of receiving it.

Yours sincerely,
[name, role]

Dear [name],

Your request for your personal information, reference [reference]

Thank you for your request, which we received on [date]. So that we can give you the information you are looking for, it would help us to know [the specific question, for example which years, which property, or which part of your tenancy the request relates to].

Under the UK GDPR, the time we have to respond is paused until we hear from you. If you would rather we go ahead with your request as it is, please tell us and we will.

Yours sincerely,
[name, role]

Dear [name],

Your request for your personal information, reference [reference]

We are writing about your request, which we received on [date]. We need to extend the time we have to respond by [one / two] months, to [new deadline], as the UK GDPR allows for [complex requests / a number of requests from the same person].

This is because [specific reason, for example the information is held in several systems over [number] years and includes information about other people that we need to consider carefully].

We will send you what we can as soon as it is ready. You have the right to complain to us about this, and to the Information Commissioner's Office at ico.org.uk.

Yours sincerely,
[name, role]

Dear [name],

Your request for your personal information, reference [reference]

We enclose a copy of the personal information we hold about you, in response to your request received on [date].

We searched [list of systems and records] for information about you from [date] to [date].

We use your information to [purposes], and the types of information we hold are [categories]. We share it with [recipients]. We keep it for [period, or how we decide]. Where it did not come from you, it came from [sources]. [We do not make decisions about you by automated means. / We make the following automated decisions: (details).] More detail is in our privacy notice at [link].

[Some information has been removed or withheld because it is about other people, or because an exemption in the Data Protection Act 2018 applies.]

You have the right to ask us to correct or delete information, to restrict or object to how we use it, and to complain to us. If you are not happy with how we have handled your request, you can complain to the Information Commissioner's Office at ico.org.uk.

Yours sincerely,
[name, role]

Dear [name],

Your request for your personal information, reference [reference]

We have considered your request, which we received on [date]. We will not be complying with it because we consider it [manifestly unfounded / manifestly excessive] under Article 12(5) of the UK GDPR.

This is because [specific reasons, with the facts relied on].

If you disagree, you can complain to us at [contact details]. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, and to seek to enforce your right of access through the courts.

Yours sincerely,
[name, role]