No Response to Your SAR?
What to do if you don't get a response or you're unhappy with it
Sometimes you might be unhappy with the outcome of your request, but the organisation has done everything they have to do. Before making a complaint, it's worth checking our guidance to understand what organisations should do when handling a SAR.
Step 1: Read the Guidance First
From the ICO:
"Before you make a complaint, read our guidance about making a SAR to check if the organisation has followed the law."
— Information Commissioner's Office
This is an important first step. Sometimes an organisation may have followed the law correctly, even if you're unhappy with the outcome. Understanding your rights and their obligations will help you determine whether a complaint is justified.
Step 2: Complain to the Organisation First
If It's Been Over a Month with No Response
If it has been over one month since you made your request and you've not heard from the organisation, you should send them a follow up email or letter.
If You've Received a Response but Are Unhappy
If you've already received a response to your SAR, but are unhappy for any reason, you should first complain to the organisation. We recommend that you do this by email, where possible.
Tip: If you think personal information is missing from the response, you should clearly list what other information you think they also have. This will help them review their records.
Keep Records of Everything
Remember to keep copies of any letters or emails about your complaint, or written records about any calls or meetings you've had, as evidence. You'll need these if you later complain to the ICO.
Complaint Letter / Email Template
From the ICO: "You could use the following complaint letter or email template as a guide, adding in the details of your own complaint:"
[Your full address] [Phone number] [date] [Name and address of the organisation] [Reference number (if the organisation has given you one)] Dear [Sir or Madam / name of the person you have been in contact with] Subject access request complaint [Your full name and address and any other details such as account number so they know who you are] I'm concerned you haven't done everything you're meant to. [Give details of your complaint clearly and simply and, if needed, its effect on you. Examples of what you may wish to say are: You haven't sent me the following information: [List clearly what other information you think they still have] You've removed or blacked out information and you haven't explained why. [Give details of the email or document where they've removed or blacked out information.]] I understand that before reporting my complaint to the Information Commissioner's Office (ICO) I should give you the chance to deal with it. I'll give a copy of your reply to the ICO if I decide I still want to report my complaint to them. You can find guidance on what you're meant to do if you receive a subject access request on the ICO's website (www.ico.org.uk or https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/helping-you-find-subject-access-request-resources/). There's also information on their regulatory powers and the action they can take. Please respond fully within one calendar month. If you can't reply within that time, please tell me when you will be able to reply. If you'd like to discuss this, please contact me on [telephone number / email address]. Yours sincerely [Signature]
Step 3: Complain to the ICO
From the ICO:
"Once you have followed the steps above, you can make a complaint to us."
"You should raise your complaints with us within three months of your last meaningful contact with the organisation."
"Remember to send us copies of all the key documents you have kept as evidence to support your complaint."
— Information Commissioner's Office
What the ICO Will Do
"We will consider your complaint in line with our obligation under Section 165 of the Data Protection Act 2018. This requires us to take steps to consider and respond to complaints from people who believe there has been an infringement of their data protection rights. This includes investigating to the extent we feel is appropriate and informing you of the outcome of your complaint."
What the ICO Cannot Do
The ICO cannot:
- Act as your representative
- Award compensation
Your Right to Go to Court
"You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise you to seek independent legal advice first. We cannot help you with this process."
At a Glance: What to Do
Read guidance
Check if they've followed the law
Complain to organisation
Use template letter, keep records
Complain to ICO
Within 3 months of last contact
- ICO – Your right to get your data
- ICO – Right of access guidance
- Data Protection Act 2018 – Section 165 (ICO's duty to consider complaints)
This guide incorporates text from the Information Commissioner's Office (ICO) guidance, reproduced under their copyright terms.