In the UK, you can ask a retailer for the personal data it holds about you under the UK GDPR. A police request follows a different route when your information is being used for law-enforcement purposes: Part 3 of the Data Protection Act 2018. Send the request to the organisation’s data-protection contact, describe the records and dates that will help it search, and keep proof of what you sent.
A retailer normally has one month to respond, although a genuinely complex or extensive UK GDPR request can be extended by up to two further months with notice. A Part 3 police request is normally due within one month and has no equivalent complexity extension. Proportionate identity checks or clarification can postpone when the response period starts.
As an Amazon Associate I earn from qualifying purchases.
What a subject access request gives you
A subject access request (SAR) is a request for a copy of your own personal information and supplementary information about how it is used. The right helps you understand what an organisation knows about you, why it uses that information, where it obtained it, who receives it, and how long it keeps it. The Information Commissioner’s Office describes access as a fundamental data-protection right.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe right is to personal information, not automatically to every document that contains it. A response can include structured records, correspondence, call recordings, chat transcripts, CCTV extracts, account notes, search results and information about profiling or fraud checks when those items relate to you. It does not give you an automatic entitlement to another person’s data, an unredacted witness statement or every document in a criminal case.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the correct route before you write
Retailer: UK GDPR access request
A retailer’s ordinary customer, loyalty, order, complaints, marketing and account processing is generally handled under the UK GDPR. Use the retailer’s current privacy notice to find its privacy, data-protection or customer-service contact. You do not need special legal wording: state clearly that you want access to your personal data.
Police force: Part 3 law-enforcement request
Police processing for a primary law-enforcement purpose is generally governed by Part 3 of the Data Protection Act 2018. Law-enforcement purposes include preventing, investigating, detecting or prosecuting criminal offences and executing criminal penalties. The ICO summarises this route as “a request made by, or on behalf of, someone for their personal information when you are using it for one of the law enforcement purposes.”
A Part 3 request has no formal wording requirement. It may be verbal or written, can be sent to any part of the force and does not have to use the phrases “subject access request”, “right of access” or “section 45(1) of the DPA”. In practice, use the force’s published data-protection or SAR address so the request is logged and routed without delay.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →When both regimes may appear in one response
A force can hold information about you for general administration as well as for policing. The primary purpose for which a particular item is being processed determines whether UK GDPR or Part 3 applies. Different sections of one response can therefore be handled under different regimes. Ask the force to identify, where it can do so without undermining a restriction, which regime applies to the information it has withheld or supplied.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Issue | Retailer request | Police law-enforcement request |
|---|---|---|
| Legal regime | UK GDPR general processing | Part 3, Data Protection Act 2018 |
| Normal deadline | One month after the organisation has the information it needs | Without undue delay and no later than one month after receiving the request or required identity, authority or fee information |
| Complexity extension | Up to two additional months for a complex or numerous request, with an explanation within the first month | No UK GDPR two-month complexity extension |
| Useful contact | Privacy, data-protection or customer-service contact in the privacy notice | Published force data-protection or SAR contact |
| Helpful identifiers | Account or loyalty number, email and postal addresses, order or case references, stores, channels and dates | Names and aliases, date of birth, addresses, incident or crime numbers, custody or stop-search references, vehicle details, officers, stations and date ranges |
| Typical restrictions | UK GDPR exemptions, including protection of other people’s information and legal privilege | Part 3 restrictions protecting policing, other people, legal professional privilege or national security |
| Escalation | Controller or data-protection officer complaint, then ICO complaint; court enforcement may also be available | Force complaint or data-protection officer review, then ICO complaint; court enforcement and legal advice may be appropriate |
Prepare information that makes a search effective
Confirm who holds the data
Address the request to the organisation that decides why and how the information is used. For a retailer, check the latest privacy notice rather than relying on an old email address. For a police force, use its current data-protection or subject-access channel, even though a Part 3 request can legally be sent elsewhere in the force.
Give identifiers and a realistic date range
Include enough detail to distinguish you from other customers or people in the force’s systems:
- Full name, former names or aliases and date of birth where relevant.
- Current and previous addresses, email addresses and telephone numbers used with the organisation.
- Retailer account, loyalty, order, complaint or case references.
- Police incident, crime, custody or stop-search numbers; vehicle registration; officers, stations or units involved.
- A date range, store, website, app, telephone channel or other location connected with the records.
Ask for the categories that matter to you instead of demanding “everything” without explanation. Examples include orders, returns, delivery records, CCTV, calls, chats, complaints, fraud flags, account notes, marketing preferences and profiling for a retailer; or incident reports, custody records, stop-search records, officer notes, correspondence and recordings for a force.
Recommended Free Tools
Decide whether you need a copy or confirmation
Say that you want a copy of your personal information. If you only need confirmation that a particular item is held, say so; otherwise, “please provide a copy” avoids an unnecessarily narrow response.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Plan identity or authority evidence
An organisation may ask for proportionate proof of identity when it has reasonable doubts. It should not routinely demand identity documents when it is already confident who you are. If you apply for someone else, the controller can ask for evidence that you are authorised to act for that person.
Send only what is reasonably necessary and use the organisation’s secure upload or encrypted method when offered. The response period can wait until the requested identity or authority evidence has been received. Keep a copy of every document and the date it was supplied.
How to make a retailer SAR
- Find the current contact route. Open the retailer’s privacy notice and select its privacy, data-protection or customer-service contact for access requests.
- State the request plainly. Say that you are requesting access to your personal data under the UK GDPR. No prescribed phrase is required.
- Identify yourself. Supply the account details, contact details, order or case references and other identifiers that match the retailer’s records.
- Define the search. List the relevant record types, stores or channels and date range. If you are concerned about a particular decision, name it and request related profiling, fraud or complaint records where applicable.
- Specify delivery. Ask for the response in a secure electronic format, such as a protected download or encrypted file, if that is suitable for you.
- Keep evidence. Save the final request, attachments, delivery confirmation and any acknowledgement. Note the date on which the retailer had all identity or clarification information it requested.
A concise request can look like this:
Subject: Subject access requestI am requesting a copy of my personal data and the supplementary information about its use.Name: <full name>Previous names: <names, if relevant>Account or loyalty number: <number>Addresses and email addresses used: <details>Records requested: <orders, calls, chats, CCTV, complaints, profiling or other categories>Date range and locations: <dates, stores, website or channels>Please provide the response securely in electronic form. If you need proportionate identity evidence or clarification, tell me exactly what is required.
How to make a police Part 3 request
- Use the force’s data-protection contact. Look for its published subject-access or data-protection route so the request reaches the team that handles Part 3 rights.
- Describe the law-enforcement information sought. State that you want your personal information and a copy of the records, not merely confirmation that information exists.
- Supply identifiers. Include names and aliases, date of birth, addresses, incident or crime numbers, custody or stop-search references, vehicle details, relevant officers or stations and the dates involved.
- Separate incidents or periods. If you have several matters, list each incident number or date range and the record types you want for it. This helps the force search without guessing which event you mean.
- Ask for an explanation of any restriction. Request the reason for withheld or redacted information and details of the complaint or enforcement route, to the extent that giving that explanation would not undermine the restriction.
- Retain the submission trail. Keep the email, web-form receipt, letter, delivery evidence, identity documents, authority evidence and every clarification exchange.
There is no requirement to use the words “subject access request”, but using them in the subject line can make routing easier. A verbal request is legally possible; a written request is usually easier to prove and to define.
Deadlines, the response clock and fees
Retailer timing under the UK GDPR
The normal response period is one month. For a complex or numerous request, the retailer can take up to two additional months, but it must explain the extension within the first month. The ICO states: “The one-month time limit for the organisation to reply to your request only starts once they have what they need from you.” In practice, a proportionate identity check or a necessary clarification can move the start date until you supply it.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
A first SAR is normally free. A reasonable administrative fee is limited to requests that are manifestly unfounded or excessive. Further copies of information already supplied can attract a reasonable fee.
Police timing under Part 3
A force must respond without undue delay and no later than one month after receiving the request, or one month after receiving identity information, representative-authority evidence or a lawfully requested fee. The UK GDPR extension for complex requests does not apply to information collected or used for law-enforcement purposes.
Track the date correctly
Record both the date you submitted the request and the date you supplied anything the organisation said it needed. If the organisation asks an unclear or disproportionate question, ask it to explain why the information is necessary and what part of the request it affects. Reply promptly to a legitimate clarification request because the clock may stop while the organisation cannot understand the scope.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Why a police response may be redacted or restricted
Protecting an active or possible law-enforcement purpose
Part 3 permits restrictions where disclosure could prejudice a law-enforcement purpose. For example, revealing a source, investigative method or information about another person could interfere with prevention, detection, investigation or prosecution. The force must apply the Part 3 rules; it cannot simply substitute a UK GDPR exemption because that seems more familiar.
Protecting other people and privileged material
Your SAR concerns your personal information. Information identifying witnesses, victims, complainants, officers or other members of the public may be removed or withheld. Legal professional privilege and national-security considerations can also restrict disclosure.
What the force should tell you
Where possible, the force should explain what it has withheld, why it has done so, and how to complain or seek court enforcement. It may limit that explanation if giving more detail would itself undermine the restriction. A heavily redacted response is not automatically unlawful, but it should still reflect a genuine assessment of the relevant Part 3 rules.
What a SAR cannot replace
A SAR is not a discovery process for a civil claim or a way to obtain an unredacted witness statement. If you need documents as evidence, the appropriate route may be disclosure through the court, advice from a solicitor or another advice service. The ICO’s Part 3 guidance identifies those alternatives where SAR material is unlikely to provide the evidence you need.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not broaden a request into “every document in the criminal file” expecting the force to provide material that does not constitute your personal information. Instead, identify the personal information you want and obtain litigation disclosure advice separately.
If the response is late, incomplete or unclear
- Check the dates. Confirm when the organisation received the request and when you supplied any identity, authority, fee or clarification it required.
- Write to the organisation’s review route. Ask its data-protection officer or complaints team to review the missed deadline, unexplained redaction or apparently incomplete search. Refer to the specific record category or date range that appears to be missing.
- Ask focused questions. Request confirmation of which systems, stores, stations, incident numbers or date ranges were searched, where that information can be provided without compromising a restriction.
- Complain to the ICO. Submit the request, delivery proof, identity or authority documents, clarification exchanges, response and your complaint correspondence so the regulator can see the timeline.
- Consider enforcement or legal advice. Where rights have been restricted or a dispute remains significant, court enforcement may be available. If the underlying issue is litigation, seek advice about the court’s disclosure process rather than relying on the SAR alone.
Examples of useful scope
Retailer account and CCTV concern
Instead of asking for every record the retailer has ever created, identify the account email, the store or website, the transaction dates, the relevant CCTV time window and the complaint reference. Ask separately for order history, customer-service calls, chat transcripts, complaint notes, CCTV showing you and any fraud or profiling information connected with the incident. This gives the controller a workable search while preserving the categories that matter.
Police stop-search or custody concern
List the stop-search or custody date, location, vehicle details, officer or station if known, incident or record number and the specific records sought. Request your personal information in the associated reports, notes, recordings and correspondence. If another person’s information appears in the material, expect it to be considered for redaction rather than assuming the entire document will be released.
Quick Recap
Record-keeping checklist
- Final request and all attachments.
- Date and method of delivery, including web-form or email receipts.
- Identity or representative-authority evidence supplied.
- Clarification questions and your replies.
- Acknowledgement, extension notice, fee request or refusal.
- Full response, redacted pages and any explanation of restrictions.
- Complaints to the organisation and the ICO, with dates and outcomes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
