The short answer
A subject access request makes a company hand over the personal information it holds about you: the call recordings, the internal notes, the complaint file. It’s free, it’s your legal right under UK data protection law, and they get one calendar month. In a dispute, it’s how you find out what they actually wrote down.
What to do today: send the letter below to the company’s data protection contact, and note the date. The month runs from when they receive it.
Why this works
Companies write things down. The agent who took your call logged notes. The complaint handler recorded a rationale. The system kept the recording, the emails, the timestamps. When a refusal is made to your complaint, the gap between what they told you and what their own file says is usually where the complaint is won. The file is exactly what a subject access request produces.
They also know who else will read it. An ombudsman investigator asks the firm for the same records, so a company deciding whether to keep stonewalling does so knowing you’ve already seen the file it would have to hand over anyway.
The letter
Dear Data Protection Officer,
This is a subject access request under the UK GDPR.
Please provide a copy of all personal data you hold about me, including: recordings and transcripts of my calls; the complete file for my complaint, reference [number]; internal notes, emails and messages that refer to me; and the rationale recorded for any decision made about my complaint or account.
My details, to help you locate my records: [name, address, date of birth, account or reference numbers].
I look forward to your response within one calendar month, as required.
Yours faithfully,
[Name]
No special form, no fee, no reason needed. Email is fine, and the words “subject access request” simply make sure nobody misfiles it. They can ask you to confirm your identity, which is legitimate; the month runs while you do.
The clock
- Standard response time
From the day they receive it1 month - Complex or numerous requests
They must tell you within the first month+2 months
A company that needs the extension must say so, with reasons, inside the first month. Silence past the month isn’t an extension, it’s a failure you can take to the regulator.
What if they ignore it, or send almost nothing?
Chase once, in writing, restating the date they received the request. If that changes nothing, or the response is a token few pages when you asked for calls and notes, complain to the Information Commissioner’s Office at ico.org.uk. It’s free, and firms treat ICO complaints seriously because the ICO can order disclosure and worse. Name the gaps specifically: “the response contained no call recordings despite my requesting them” does more work than “they didn’t send everything”.
Common questions
Do I have to say why I want it?
No. The right isn’t conditional on a reason, and you don’t have to mention any complaint. Firms cannot refuse because they suspect you’ll use the material against them. That’s the point of the right to your data.
Can they charge me?
Not for a normal request. Only where a request is manifestly unfounded or excessive can they charge a reasonable fee or refuse, and asking for your own complaint file is neither.
When should I send one?
The moment a refusal is weak, or before escalating, the file strengthens your response to their final answer and travels with you to the ombudsman. Sending one costs nothing and often changes the company’s tone by itself.
Sources: UK GDPR right of access and response times, as explained by the Information Commissioner’s Office, the UK regulator this page’s deadlines come from.
Did the file change your complaint?