# SUBJECT ACCESS REQUEST
## Important legal, jurisdiction and formality warning
This is a fictional worked example, not legal advice, a binding decision about a controller's duties or a guarantee that any particular record will be disclosed. It is drafted for an individual making a subject access request to a controller in England and Wales under the UK General Data Protection Regulation and the Data Protection Act 2018. The controller must assess the request against the law, applicable exemptions, third-party confidentiality, legal privilege, safeguarding, crime and regulatory restrictions, identity verification, manifestly unfounded or excessive request rules and any relevant statutory code or current Information Commissioner's Office guidance. A subject access request is not a substitute for disclosure in litigation, a complaint, a freedom of information request or an employment grievance. Do not include unnecessary special-category data or identity documents in an insecure email. Obtain advice where the request concerns a serious dispute, safeguarding, law enforcement, immigration or a vulnerable person.
Date: 8 May 2027
By email and recorded post
To: Data Protection Officer, Norchester Home Services Limited, 24 Mill Yard, Nottingham NG1 2HF
Email: privacy@norchester.example.test
From: Amira Louise Patel, 62 Kingfisher Lane, Nottingham NG5 3RT
Email: amira.patel@example.test
Telephone: 0115 555 2841
Subject: Subject access request concerning customer account NHS-48271
Dear Data Protection Officer,
I am making a subject access request under Article 15 of the UK General Data Protection Regulation and the Data Protection Act 2018. I am the data subject. Please treat this letter and the email carrying it as a request for my personal data, not as a general request for Norchester Home Services Limited's documents or another person's information.
## 1. Identity and account details
My full name is Amira Louise Patel. My current address is 62 Kingfisher Lane, Nottingham NG5 3RT. I previously lived at 11 Hawthorn Court, Nottingham NG7 4LP, until 30 September 2025. My Norchester customer account number is NHS-48271 and the service address associated with the account is 11 Hawthorn Court, Nottingham NG7 4LP. My customer reference on the invoice dated 14 February 2026 is NHC-19044.
To help you locate the account, I opened a home-repair plan on 6 October 2024. The plan was closed on 31 March 2026 after I moved home. I corresponded with Leah Morgan, customer resolution adviser, and Tomasz Wrona, field scheduling officer. A repair visit took place on 18 February 2026. My request is not limited to those two employees, because other staff, contractors, processors or systems may hold relevant personal data.
I can provide a copy of my current driving licence securely if you reasonably consider it necessary for verification; please tell me the approved upload method. I am not sending a full identity document to an unverified email address. You already hold my name, former service address, account number, invoice reference and email address. If you reasonably need further verification, please explain the specific concern and the minimum information required. Please do not use an unnecessary verification request to delay the statutory response period.
## 2. Data requested
Please provide a copy of the personal data you process about me, including data held in customer, billing, complaints, repair, scheduling, call-recording, quality-assurance, fraud-prevention, debt-management and account-closure systems. The requested period is 1 October 2024 to 8 May 2027, together with older data retained in a live system where it is still used to make decisions about me or to understand the relevant account history.
The request includes, so far as personal data is concerned:
1. My account profile, contact details, former address, identity checks, preferences, consent records, marketing choices, vulnerability indicators and account notes. 2. Invoices, payment records, refunds, arrears information, direct-debit records, payment references and correspondence that identify me or record a decision about me. 3. Emails, letters, web-chat messages, text messages, call notes, complaint records and internal messages that mention me, my account, my service address or my repair request. 4. Call recordings and transcripts for calls made between 1 January 2026 and 31 March 2026, especially my call on 19 February 2026, if those recordings are still retained. 5. The work order, engineer notes, photographs, appointment history, cancellation reason, access notes and outcome relating to repair reference NHS-RP-7730 at 11 Hawthorn Court on 18 February 2026. 6. Personal data in communications with contractors, insurers, credit-reference agencies, debt-recovery providers, complaints handlers, legal advisers acting as processors, software suppliers and any other processor used for my account. 7. Records of profiling, scoring, categorisation, fraud flags, affordability checks, complaint triage or automated decision-making concerning me. Please explain the significance and envisaged consequences of any solely automated decision covered by the applicable law. 8. The purposes of processing, categories of personal data, recipients or categories of recipients, source of data not obtained from me, intended retention period or criteria, and information about my rights and safeguards. 9. A list of disclosures of my personal data to third parties during the requested period where that list can be provided lawfully, including the date, recipient category and purpose.
I am asking for my personal data, not every document in which it appears. If a document contains third-party data or legally privileged material, please provide the personal data that can reasonably be separated and explain the basis for withholding the remainder. If you withhold or redact data under an exemption, identify the exemption or statutory basis in enough detail for me to understand the decision, subject to any lawful restriction on explaining it.
## 3. Search instructions and proportionality
Please search my account number NHS-48271, customer reference NHC-19044, repair reference NHS-RP-7730, my full name, my former and current address, my email address, and the telephone number ending 2841. Please search ordinary spelling and formatting variations of my name, but do not search unrelated records about other people merely because they share my surname.
A reasonable search should include the customer relationship platform, billing platform, complaint system, repair and scheduling system, email mailbox used for customer resolution, recorded-call index, document-management system and processor records that Norchester can reasonably obtain. If a system has been retired, please state whether data was migrated, deleted under a retention policy or placed beyond ordinary access.
I understand that a controller does not have to create new information or give a copy of every original document when a clear data extract is sufficient. I also understand that an exemption may apply. This request is intended to identify and receive my personal data fairly and proportionately. Please contact me promptly if you consider that clarification would materially assist in locating the data, identifying a narrow issue or dealing with a large volume.
## 4. Timing and secure delivery
Please acknowledge receipt and confirm the identity-verification position. I understand that the usual response period is one month from receipt of a valid request and any necessary verification, and that an extension may be available for a complex or numerous request if you tell me within the required period and explain why. On the facts presently known, I ask for the response by 8 June 2027, being one calendar month after the date of this request.
Please provide the response electronically through a secure portal or an encrypted download with the password communicated separately. If your secure system cannot provide the material, please tell me the file format, maximum size and another secure method. Do not send unredacted special-category data, identity documents or call recordings to an ordinary unencrypted email if a safer method is available.
Please confirm the controller's full legal name, company registration number, data-protection contact route and any processor involved in responding. Norchester should not deliberately alter, delete or overwrite relevant data to frustrate this request. This request does not require Norchester to suspend an ordinary retention schedule that it applies in good faith, subject to any separate legal hold or preservation duty. Please preserve relevant data where reasonably necessary to handle this request and any resulting complaint.
## 5. Clarification of purpose and rights
The immediate purpose is to understand how Norchester recorded the 18 February 2026 repair, how it handled my complaint dated 24 February 2026, what personal data it shared with the contractor, and whether the account closure and final invoice were processed accurately. I may use the information to correct inaccurate data, exercise data-protection rights, resolve a consumer complaint or seek advice. This statement does not limit my legal rights or require Norchester to disclose information that the law protects from disclosure.
If the response shows inaccurate or incomplete personal data, I may ask for rectification. If processing is unlawful, unnecessary or otherwise within the relevant legal test, I may ask for erasure or restriction, but this letter is not itself a separate request for those outcomes. Please do not treat my access request as consent to marketing. My marketing preference remains no promotional telephone calls and no promotional text messages.
If you refuse all or part of the request, please give a clear explanation, identify the data category affected, state whether the refusal is based on an exemption, explain any complaint route and confirm how I can contact the Information Commissioner's Office. Please do not simply state that a document is confidential without assessing whether my personal data can be disclosed in a redacted or extracted form.
## 6. Contact and confirmation
Please communicate with me at amira.patel@example.test and copy no other person. If a telephone discussion is necessary, please email first so that I can arrange a suitable time. I prefer written confirmation of any decision, the data supplied, the searches carried out and the reasons for any omission.
Please acknowledge this request by 15 May 2027 and provide the substantive response by 8 June 2027, unless a lawful verification issue or permitted extension changes the date and you tell me promptly. I will cooperate reasonably with a proportionate verification request. Nothing in this letter waives any data-protection, consumer, contractual or procedural right.
Yours faithfully,
Amira Louise Patel
Signature: __________________________
Date: 8 May 2027
## Worked-document note
This request is a worked illustration. It does not prove that Norchester Home Services Limited is the correct controller, that every listed record exists, that every requested item is personal data, or that disclosure will be complete. In a real request, the requester should verify the controller's current name and contact details, minimise identity information sent by email, check the current UK GDPR and Data Protection Act 2018 position, and obtain advice where the circumstances make an exemption or dispute likely.