They said this… · Data protection & SARs

“You must use our SAR form or portal”

Generally incorrect

An organisation can provide a convenient form, but a valid subject access request does not generally depend on using the controller’s preferred wording or channel.

Not sure which right applies? Check your situation →

Why this answer

What actually matters

  • The request needs to make clear that the individual is asking for access to personal data.
  • Reasonable identity verification can still be requested.
  • Using the form voluntarily may make administration easier without being legally mandatory.

What you could say

Keep the response tied to the actual rule.

Evidence

What to have beside you

  • Original request/complaint and proof of receipt
  • Every ID, clarification or extension message
  • A list of data categories you know or reasonably expect to exist
  • The response pack, redactions, file metadata and missing categories

If they still refuse

Move the dispute forward.

  1. Challenge the controller precisely: identify the missing data, disputed accuracy or rule you say has been misapplied.
  2. Use the organisation’s data-protection complaint route where appropriate.
  3. The ICO can consider data-protection compliance, but compensation normally requires a different route.

Read the full rules

Go deeper before escalating.

Primary guideRead the detailed ConsumerWise guidance.Subject access requestsRead the full guide.Challenging a SAR responseRead the full guide.Data accuracyRead the full guide.