The Nightmare Subject Access Request

Take Control of Your Personal Data. Know What Organisations Know About You.

Every time you interact with a business or organisation, you leave behind personal information. But how much do they hold about you, what do they do with it, who do they share it with, and how securely is it protected?

The Nightmare Subject Access Request is a comprehensive template designed to help you exercise your legal right to access your personal data under Article 15 of the UK General Data Protection Regulation (UK GDPR).

Unlike a basic Subject Access Request (SAR), this enhanced template encourages closer scrutiny of how organisations collect, use, store, share and protect your personal information.

How to Use It

1. Personalise the template – Add your name, contact details and relevant account information.

2. Identify the organisation – Send the request to its Data Protection Officer, privacy team or designated contact.

3. Submit your request – Send it by email or another recognised channel, keeping a copy and proof of submission.

4. Monitor the deadline – Organisations must generally respond within one month, although lawful extensions and other timing rules may apply.

5. Examine the response – Check whether your personal data and the legally required information have been supplied, and whether omissions or refusals are adequately explained.

6. Challenge non-compliance – If the response is inadequate, raise your concerns with the organisation and, if necessary, the Information Commissioner's Office (ICO).

Important to Know

The template contains both statutory requests for personal data and additional questions about cybersecurity, data breaches and organisational safeguards. Not every question creates an automatic legal entitlement to an answer, but the additional enquiries can help you assess an organisation's approach to protecting your information.

Your personal data belongs at the centre of your privacy rights. You have the right to ask what is held about you, understand how it is used, and challenge failures to comply with data protection law.

The Nightmare Subject Access Request is intended to help individuals exercise their privacy rights. It is a general-purpose template, not legal advice, and should be adapted to the organisation and applicable data protection legislation.

THE NIGHTMARE SUBJECT ACCESS REQUEST TEMPLATE

PRIVATE AND CONFIDENTIAL

FORMAL SUBJECT ACCESS REQUEST — ARTICLE 15 UK GDPR

AND SEPARATE DATA SECURITY AND PERSONAL DATA BREACH ENQUIRY

To: The Data Protection Officer / Privacy Officer
Organisation: [Full legal name of organisation]
Date: [Date]

From: [Your full name]
Registered email address: [Email address]
Account/customer reference: [If applicable]
Correspondence address: [Your address]

Dear Data Protection Officer,

FORMAL EXERCISE OF STATUTORY RIGHTS

I am writing to formally exercise my right of access under Article 15 of the United Kingdom General Data Protection Regulation (UK GDPR), read together with Articles 12 and 12A and the Data Protection Act 2018, as amended.

I require confirmation of whether your organisation processes personal data concerning me, copies of the personal data to which I am entitled, and the supplementary information prescribed by Article 15.

This request concerns personal data relating to me, whether held directly by your organisation, by a processor acting on your behalf, or within systems and records for which you are the relevant data controller.

For clarity, this correspondence is divided into:

• Part A: My formal statutory subject access request.

• Part B: A separate enquiry concerning data security, potential unauthorised access and personal data breaches.

• Part C: Procedural requirements and response accountability.

Part A is intended to exercise my statutory right of access. Part B contains additional questions which may extend beyond Article 15 and should be treated separately where necessary.

The additional enquiries in Part B must not be treated as grounds for delaying, narrowing or rejecting the statutory request in Part A.

PART A — STATUTORY SUBJECT ACCESS REQUEST

1. Confirmation of processing and disclosure of personal data

Pursuant to Article 15(1) and (3), please:

1.1 Confirm whether you currently process personal data concerning me.

1.2 Provide a copy of the personal data to which I am entitled following a reasonable and proportionate search of your records.

1.3 Include personal data held in structured and unstructured formats, insofar as such data falls within the scope of my right of access.

Without limiting this request, I ask you to consider the following categories where relevant:

a. Account registration information, identity records, customer profiles and contact information.

b. Account history, transaction records, service records, billing information and payment-related personal data.

c. Customer relationship management records, case notes, complaints, support tickets and internal account annotations.

d. Internal and external correspondence containing personal data relating to me, including emails, attachments and relevant electronic messages.

e. Recorded telephone calls, transcripts, chat histories and other retained communications.

f. Personal data contained in authentication records, account access histories, security alerts and relevant audit trails.

g. Personal data contained in internal assessments, reviews, investigations and decisions concerning me.

h. Recorded opinions, evaluations, classifications, flags, risk indicators or assessments concerning me.

i. Profiles, scores, predictions, inferences and other derived personal data relating to me.

j. Marketing preferences, consent records, suppression records and relevant changes to those records.

k. Personal data contained in relevant archived records and backup environments, insofar as it is within the applicable right of access and reasonably retrievable.

l. Any other personal data relating to me identified through your reasonable and proportionate searches.

1.4 Where necessary to make the personal data intelligible, please provide sufficient context to explain relevant fields, codes, abbreviations, classifications, dates, status indicators and recorded decisions.

I am requesting access to my personal data, not indiscriminate copies of documents unrelated to me.

Where documents contain both my personal data and information about other individuals, please consider whether appropriate redaction or extraction permits disclosure of the information to which I am entitled.

2. Purposes and categories of processing

Pursuant to Article 15(1)(a) and (b), please identify:

2.1 The purposes for which my personal data is processed.

2.2 The categories of personal data concerned.

2.3 Where reasonably possible, the relationship between those categories and the purposes for which they are processed.

For example, please distinguish processing for account administration, service delivery, billing, marketing, profiling, fraud prevention, security, legal compliance and other relevant purposes.

Where existing records contain personal data about actual processing events, account decisions or disclosures concerning me, please include that personal data within your response.

3. Third-party recipients and disclosures

Pursuant to Article 15(1)(c), I specifically request the identities of the recipients to whom my personal data has been disclosed or will be disclosed, subject to the qualifications recognised by applicable law.

Please provide:

3.1 The actual identities of identifiable external recipients of my personal data, including relevant service providers, processors, business partners and other third parties.

3.2 The categories of my personal data disclosed to those recipients, where that information is available.

3.3 Copies of my personal data contained in existing disclosure records, data-sharing histories or relevant transmission records, insofar as they fall within Article 15.

3.4 Where identifying particular recipients is impossible, or another lawful restriction applies, please provide the applicable recipient categories and explain the limitation insofar as you are legally able to do so.

Please do not substitute generic categories of recipients for actual identities where the latter must lawfully be provided.

4. International transfers

Where my personal data has been or will be transferred outside the United Kingdom, please identify the recipients or relevant categories of recipients in third countries or international organisations as required by Article 15(1)(c).

Where such transfers rely on Article 46 UK GDPR, please provide the information about the applicable transfer safeguards required by Article 15(2).

In particular, please explain, where applicable:

a. The relevant destination countries or international organisations.

b. The categories of my personal data involved.

c. The safeguards applicable to qualifying transfers under Article 46.

d. How I may obtain further information concerning those safeguards.

Requests for additional information about global data storage and access arrangements are addressed separately in Part B.

5. Data retention

Pursuant to Article 15(1)(d), please identify:

5.1 The envisaged period for which each relevant category of my personal data will be stored, where possible.

5.2 Where a definite retention period cannot be specified, the criteria used to determine that period.

5.3 The relevant distinctions, where applicable, between records retained for account administration, contractual purposes, legal obligations, complaints, fraud prevention, security or other processing purposes.

Please also provide my personal data contained in existing retention, deletion or account-closure records where those records fall within the scope of Article 15.

6. Sources of personal data

Pursuant to Article 15(1)(g), where personal data concerning me was not obtained directly from me, please provide all available information concerning its source.

This includes, where relevant, personal data obtained from:

a. Third-party commercial organisations or data suppliers.

b. Credit reference, identity verification or fraud prevention services.

c. Marketing, advertising or data-matching partners.

d. Publicly accessible sources.

e. Other controllers, processors or business partners.

f. Automated systems generating inferred or derived personal data.

Please identify the source as specifically as the information available to you permits.

7. Automated decision-making, profiling and derived information

Pursuant to Article 15(1)(h), and taking account of the current provisions on automated decision-making under Articles 22A–22C UK GDPR, please confirm whether personal data concerning me has been processed in connection with automated decision-making or profiling.

7.1 Please provide copies of relevant personal data concerning me, including existing:

a. Profiles and classifications.

b. Risk, fraud, trust or eligibility scores.

c. Behavioural assessments or predictions.

d. Account or customer segmentation data.

e. Automated flags, restrictions or warnings.

f. Recorded automated decisions and their outcomes.

g. Personal input data used to generate such results, insofar as that information falls within my right of access.

7.2 Where automated decision-making concerning me is subject to the safeguards required by Article 22C, please provide the supplementary information required by Article 15(1)(h), including meaningful information about the logic involved, the significance of the processing and its envisaged consequences for me.

7.3 Where a significant solely automated decision concerning me is subject to Article 22C, please explain the applicable arrangements for making representations, obtaining human intervention and contesting that decision.

7.4 Where profiling information concerning me exists but does not involve a significant solely automated decision, please nevertheless provide the personal data relating to me that falls within the ordinary scope of Article 15.

I am not requesting unrestricted access to proprietary source code or trade secrets. My request concerns my personal data and the explanations or safeguards required by law.

8. Records relating to access, misuse and security incidents

As part of my statutory right of access, please consider existing records containing personal data relating to me within:

8.1 Account access and authentication histories.

8.2 Security alerts, account recovery records and relevant access-control audit entries.

8.3 Recorded investigations into suspected unauthorised access to my account or personal information.

8.4 Internal reports or case notes concerning suspected misuse, inaccurate disclosure or unauthorised alteration of my personal data.

8.5 Personal data breach records or incident investigations that contain personal data relating to me.

8.6 Existing records of disclosures of my personal data to third parties following security incidents.

Please provide copies of the personal data within these records where disclosure is required by Article 15, subject to applicable exemptions and the rights of others.

I recognise that Article 15 does not automatically entitle me to complete security logs, confidential investigation reports or information relating solely to other individuals.

However, the existence of security-sensitive material within a record does not, by itself, resolve whether personal data relating to me contained within that record can lawfully be disclosed.

9. Information concerning my statutory rights

Please provide the supplementary information required by Article 15(1)(e), (ea) and (f), including information about:

a. My rights to request rectification or erasure.

b. My rights to request restriction of processing or to object to processing.

c. My right to make a complaint to your organisation.

d. My right to make a complaint to the Information Commission.

Where this information is provided through an existing privacy notice, please identify the relevant current provisions clearly.

PART B — SEPARATE DATA SECURITY AND PERSONAL DATA BREACH ENQUIRY

The following enquiries arise from my interest in understanding whether my personal data has been adequately protected and whether any identified security incident may have affected it.

I recognise that not every question in this section constitutes an enforceable Article 15 demand.

Please answer these questions separately, to the extent that you can lawfully and reasonably do so. Where a separate statutory obligation applies, including under Article 34 UK GDPR, please address that obligation independently.

10. Potential personal data breaches

Please confirm, on the basis of your existing incident records and available information, whether your organisation has identified any personal data breach or unauthorised disclosure affecting my personal data.

Where such an incident has been identified, please provide, insofar as disclosure is lawful and appropriate:

10.1 A description of the nature of the incident.

10.2 The date or estimated period during which the incident occurred.

10.3 The date on which the incident was discovered.

10.4 Whether the incident arose within your organisation or involved an external recipient or processor.

10.5 The categories of my personal data known or reasonably believed to have been affected.

10.6 Whether your assessment identified a risk or high risk to my rights and freedoms.

10.7 Whether notification to me was required under Article 34 UK GDPR and, where relevant, how that obligation was addressed.

10.8 The general nature of the remedial measures taken or proposed.

10.9 Any practical steps you recommend I take to protect myself against identity theft, fraud, account compromise or other relevant harm.

10.10 A contact point from which I can obtain further assistance concerning the identified incident.

Where an incident affected my personal data but I was not individually notified, I would welcome an explanation of the relevant notification assessment and any applicable Article 34(3) exception.

This enquiry is not intended to require a speculative guarantee that no undiscovered security incident has ever occurred.

11. Data storage, international access and cloud processing

Please provide a high-level explanation of your current arrangements for storing and accessing personal data relating to me.

In particular, please identify, where reasonably available:

a. The countries or broad jurisdictions in which my personal data is stored.

b. The jurisdictions from which authorised external service providers may remotely access it.

c. Whether relevant cloud infrastructure or outsourced processing arrangements are used.

d. Whether archived or backup copies may be held in different jurisdictions.

e. The general framework applied to international access and transfers.

I am not requesting specific server addresses, confidential network diagrams or information that would materially compromise system security.

12. Technical and organisational security measures

Please explain, at an appropriate high level, which categories of technical and organisational safeguards you use to protect personal data, particularly where those safeguards apply to my information.

I am interested in whether your security arrangements include:

a. Encryption of personal data in transit and at rest, where appropriate.

b. Appropriate access controls, identity management and authentication.

c. Logging and monitoring of access to relevant personal data.

d. Measures to detect suspicious or unauthorised activity.

e. Controls intended to prevent unauthorised disclosure or exfiltration.

f. Data minimisation and retention controls.

g. Backup, recovery and business continuity arrangements.

h. Procedures for assessing, managing and responding to personal data breaches.

i. Controls over processors, contractors and external recipients.

j. Relevant external security assurance, audits or certification, including ISO/IEC 27001 where applicable.

I do not require disclosure of confidential security configurations, passwords, encryption keys, detailed detection rules or other information that would expose your systems to additional risk.

A high-level, accurate description of applicable controls would be sufficient for this separate enquiry.

13. Employee and contractor access

Please explain, at a general level, the arrangements your organisation uses to control access to personal data by employees and contractors.

In particular:

13.1 Whether access to personal data is restricted according to defined roles or legitimate business needs.

13.2 Whether access to sensitive systems is logged or subject to monitoring.

13.3 Whether procedures exist to investigate suspected inappropriate access or disclosure.

13.4 Whether relevant staff receive data protection and information security training.

13.5 Whether your organisation has identified any incident involving inappropriate employee or contractor access to my personal data.

Where existing investigation or access records contain personal data relating to me, my request for that information is already made in Part A.

I am not requesting confidential disciplinary information about employees or unrelated customers.

14. Lawful processing and additional transparency

As a separate transparency enquiry, please identify, where not already adequately explained in information previously provided to me:

a. The legal bases relied upon for the principal purposes for which my personal data is processed.

b. Where legitimate interests are relied upon, the interests identified by your organisation.

c. Where consent is relied upon, how my consent is recorded and how it may be withdrawn.

d. Any relevant procedures for correcting inaccurate personal data.

e. The contact details of your Data Protection Officer or other appropriate privacy contact.

Please distinguish explanations supplied in response to this additional enquiry from information disclosed pursuant to my statutory subject access rights.

PART C — PROCEDURAL REQUIREMENTS AND RESPONSE ACCOUNTABILITY

15. Scope and proportionality of searches

I acknowledge that Article 15(1A) UK GDPR requires a reasonable and proportionate search rather than an unlimited forensic investigation.

My request is nevertheless intended to cover all personal data to which I am entitled under Article 15 and should not be interpreted as restricted to data displayed within my online account or within customer-facing systems.

Please consider the information reasonably retrievable across relevant internal records, retained communications, operational systems and processors acting on your behalf.

If you consider clarification reasonably necessary to identify particular records or processing activities, please explain what information is required and why.

I am willing to assist with specific identifiers or contextual information to facilitate an effective search.

Any such clarification should not be treated as a voluntary restriction of my statutory rights unless I expressly agree.

16. Incomplete disclosure, exemptions and withheld information

Where you do not provide information falling within a category identified in Part A, I request that your response distinguish, where reasonably possible and lawful, between:

a. Information not held.

b. Information outside the scope of my right of access.

c. Information withheld under a statutory exemption or restriction.

d. Information not retrieved because the necessary search was assessed as unreasonable or disproportionate.

e. Information that cannot be identified or located despite a reasonable and proportionate search.

Where an exemption or restriction is relied upon, please identify the relevant legal provision and explain its application insofar as you can lawfully do so.

Where a search is considered unreasonable or disproportionate, I would welcome an explanation of the circumstances and principal reasons supporting that assessment.

I do not suggest that Article 15 necessarily requires a document-by-document exemption schedule or disclosure of confidential internal search methodology.

However, a clear explanation of material limitations would help me understand and assess your response.

17. Format and secure disclosure

As this request is submitted electronically, I request that the information be provided in a commonly used electronic form, in accordance with Article 15(3), unless another arrangement is agreed.

Where reasonably practicable, I would prefer:

a. Searchable PDF for correspondence and narrative records.

b. CSV, spreadsheet or other intelligible formats for structured records.

c. Commonly usable audio or video formats for recordings.

d. Appropriate contextual information or field explanations for technical records.

Please provide the information through a secure delivery method appropriate to its sensitivity.

Where a secure portal is used, please ensure that the information remains accessible for a reasonable period and that I am informed of any expiry date.

18. Identity verification

I am willing to complete reasonable and proportionate identity verification where necessary.

If further evidence is required, please explain what is needed and provide an appropriate secure means of submission.

Please avoid requesting copies of identity documents or additional personal information beyond what is reasonably necessary to verify my identity.

19. Statutory response deadline

I expect the statutory request in Part A to be handled without undue delay and within the applicable period under Articles 12 and 12A UK GDPR.

I recognise that the ordinary deadline is one month from the relevant statutory starting point, subject to lawful extensions and any applicable provisions concerning identity verification or reasonably necessary clarification.

If an extension is considered necessary because of the complexity or number of requests, please notify me within the period required by Article 12A and explain the reasons.

Please also confirm the applicable response deadline.

The discretionary questions in Part B should be handled separately where necessary and should not delay the statutory disclosure.

20. Response completeness and accountability

To assist in assessing the completeness of your response, I request, as a practical administrative measure, that you identify which numbered sections of Part A have been addressed.

A short accompanying index or response schedule would be helpful.

Please also identify an appropriate contact through whom I may raise any questions concerning apparent omissions, exemptions, unintelligible data or inconsistencies.

Where I raise a subsequent complaint alleging an infringement of data protection law, I expect it to be handled in accordance with the applicable provisions of the Data Protection Act 2018, including section 164A where relevant.

I reserve my rights to raise unresolved concerns with the Information Commission and to pursue other remedies available under applicable law.

My intention is to obtain a complete, accurate and intelligible account of the personal data processed about me and to understand whether any identified security incident has affected that information.

I trust that the statutory and supplementary enquiries will receive proper and proportionate consideration.

Please acknowledge receipt and direct this correspondence to your Data Protection Officer, privacy team or other responsible individual.

Yours faithfully,

[Your full name]
[Email address]
[Correspondence address]
[Account/customer reference, if applicable]

END OF REQUEST

Before sending

The Nightmare Subject Access Request is designed to be comprehensive without claiming rights that Article 15 does not provide. A controller can still lawfully withhold exempt information or limit unreasonable searches; no wording can eliminate those protections.

I recommend three final steps:

1. Identify the controller. Replace the placeholders with the organisation's correct legal entity and your relevant account identifiers.

2. Give Part A priority. If speed and enforceability are paramount, send Part A and Part C as the SAR and Part B as a separate enquiry. This is my preferred approach.

3. Keep evidence. Retain the exact submitted version, delivery confirmation, acknowledgement, any identity or clarification requests, and the eventual response.

This documents key legal foundations are Article 15 UK GDPR, Articles 12A and 22A–22C, and section 164A of the Data Protection Act 2018.

The result is a strong forensic request because it makes the organisation's mandatory disclosure obligations identifiable, demands the most relevant personal data, and creates a clear framework for scrutinising incomplete or evasive responses.

HOW LONG DO I GIVE THEM?

If they follow the rules they should respond within one-month period to advise that they will require a further two months (Article 12(3) GDPR). 

If you have not had a full response in 3 months, then you could file a complaint with the Information Commissioners Office.