How Data Privacy Works: The Full Breakdown of What Are Subject Access Requests

Published 2 September 2026

In an era where personal data fuels everything from targeted advertising to credit scoring, the ability to demand transparency about how your information is used has never been more critical. What are subject access requests? At their core, they represent a legal mechanism for individuals to exercise control over their own data—yet their scope, limitations, and practical implications remain misunderstood by many. Whether you’re a privacy advocate, a business navigating compliance, or simply someone curious about your rights, understanding how these requests operate is essential.

The concept of subject access requests isn’t new, but its evolution—particularly under modern data protection laws like the EU’s GDPR—has transformed it into a powerful tool for accountability. Companies now face strict deadlines, hefty fines for non-compliance, and the expectation to provide not just data, but context: why it was collected, how it’s used, and who has access. This shift reflects a broader societal move toward treating personal data as an asset that belongs to the individual, not the corporation.

Yet for all their importance, subject access requests remain shrouded in ambiguity for many. How do you make one? What happens if a company refuses? Can you request corrections alongside your data? The answers to these questions determine whether data privacy remains a theoretical right or becomes a tangible reality for millions.

The Complete Overview of What Are Subject Access Requests

The legal framework surrounding subject access requests is designed to balance two critical interests: the individual’s right to privacy and the organization’s need to operate efficiently. However, the balance isn’t always straightforward. For instance, while GDPR grants individuals the right to access their data "without undue delay," it also allows controllers to charge a "reasonable fee" for manifestly unfounded or excessive requests—a provision that has sparked debates over access barriers. The tension between openness and operational practicality underscores why understanding the mechanics of these requests is vital for both rights holders and businesses.

Historical Background and Evolution

The turning point came with the GDPR in 2018, which expanded the scope of subject access requests significantly. No longer limited to basic data disclosure, GDPR requests now include:

This evolution reflects a broader shift in data governance, moving from reactive compliance to proactive transparency. The GDPR’s provisions also introduced stricter penalties for non-compliance, with fines reaching up to 4% of global annual turnover or €20 million (whichever is higher), depending on the violation’s severity.

Core Mechanisms: How It Works

Once received, the controller has one month to respond (extendable to two months in complex cases). The response must be in a "clear and intelligible" format, often requiring data to be provided in a commonly used electronic format (e.g., CSV, PDF) to facilitate portability. Notably, controllers are not obligated to provide data in a specific format if doing so would adversely affect others’ rights or freedoms. However, they must justify any refusal, which can be challenged by the individual or supervisory authorities like the UK’s Information Commissioner’s Office (ICO) or the EU’s national DPAs.

Key Benefits and Crucial Impact

At its heart, the right to access personal data is about empowerment. It allows individuals to:

As one privacy advocate noted: "Data protection laws are only as strong as the mechanisms that allow individuals to exercise their rights. Subject access requests are the backbone of that system."

"The right to access one’s personal data is not just a legal nicety—it’s a cornerstone of democratic accountability. Without it, individuals are left in the dark about how their lives are being shaped by algorithms and corporate decisions." — Dr. Sarah Chalmers, Data Privacy Researcher, University of Edinburgh

Major Advantages

• Transparency: Individuals gain visibility into how their data is collected, stored, and shared, reducing opacity in data processing.
• Error Correction: Requests often reveal inaccuracies (e.g., outdated credit scores, incorrect medical records), allowing for timely corrections.
• Consent Management: Organizations must document the legal basis for data processing, prompting them to review and update consent mechanisms.
• Risk Mitigation: Proactive compliance with subject access requests reduces the likelihood of regulatory fines or reputational damage from data mishandling.
• Innovation Incentive: By clarifying data usage rights, businesses can develop more ethical AI and analytics models, aligning with consumer expectations.

Comparative Analysis

Future Trends and Innovations

Another emerging area is the global harmonization of data rights. As multinational corporations operate across jurisdictions with divergent laws, there’s growing pressure to standardize subject access requests to avoid regulatory arbitrage. Initiatives like the International Data Privacy Framework (a US-EU agreement) and the Asia-Pacific Privacy Charter signal steps toward convergence, though challenges remain in balancing cultural differences in privacy expectations.

Additionally, the rise of decentralized identity solutions (e.g., self-sovereign identity models) may redefine how individuals exercise their rights. Instead of relying on third-party requests, users could directly access and manage their data via blockchain or other distributed ledgers, bypassing traditional controllers. This shift could render subject access requests as we know them obsolete—or at least, significantly altered.

Conclusion

As data privacy laws mature and technology advances, the principles underlying subject access requests will likely remain central to democratic governance. The challenge lies in ensuring that these rights are not just theoretically guaranteed but practically accessible to all. For now, the onus is on both individuals and organizations to navigate this landscape with clarity, vigilance, and a shared commitment to transparency.

Comprehensive FAQs

Q: Can I make a subject access request verbally?

A: While some organizations may accept verbal requests, laws like GDPR require them to be made in writing (e.g., email, letter) to create an auditable record. Verbal requests can be ignored or misplaced, so always document your inquiry in writing.

Q: What if a company refuses to comply with my subject access request?

A: If a controller unjustifiably refuses or delays your request, you can escalate the matter to your country’s data protection authority (e.g., ICO in the UK, CNIL in France). You may also have grounds to pursue legal action for damages, depending on the jurisdiction.

Q: Do subject access requests cover data held by third parties?

A: Under GDPR, if a controller shares your data with a third party (e.g., a cloud provider), they must inform you of this during the SAR response. However, the third party is not obligated to respond directly to your request unless they are a separate data controller.

Q: Can I request data in a specific format (e.g., Excel) for easier analysis?

A: Yes. GDPR mandates that data be provided in a "commonly used and machine-readable format," which often includes spreadsheets or JSON. If the controller refuses without justification, you can challenge their decision with the relevant authority.

Q: What happens if my subject access request reveals inaccuracies in my data?

A: Once inaccuracies are identified, you have the right to request corrections under GDPR (Article 16). The controller must rectify the data without undue delay, though they may need to verify the accuracy of your claim first.

Q: Are there any exceptions where a subject access request can be denied?

A: Yes. Exceptions include:

• Requests that would disclose another individual’s personal data (unless you have consent).
• Data protected by legal privilege (e.g., lawyer-client communications).
• Information that could harm public health or safety.
• Data processed solely for research purposes (if disclosure would compromise the study).

Q: How do I know if a company is complying with my subject access request?

A: Look for:

• A response within the legal deadline (1–2 months).
• Complete and accurate data disclosure (not just partial records).
• Clear explanations for any redactions or denials.
• No excessive fees for "unfounded" requests (unless justified).

• EU data regulations
• GDPR rights
• SAR compliance
• data privacy law
• data subject rights
• information rights act
• personal data requests
• subject access request process