Subject Access Requests vs FOI: A Journalist's Guide

What is a Subject Access Request?

A Subject Access Request (SAR) is a right under Article 15 of UK GDPR — retained in domestic law by the Data Protection Act 2018 — for any individual to obtain a copy of the personal data an organisation holds about them, along with supplementary information about how that data is processed. The right applies to any organisation processing personal data about you, whether public or private.

This is fundamentally different from a Freedom of Information (FOIA) request. FOIA applies only to public authorities and covers any recorded information they hold — not necessarily about you. A SAR is about your personal data held by any organisation. The two rights are complementary but serve entirely different purposes and are governed by different legislation.

For journalists, SARs are most useful when you want to understand what an organisation knows about you personally — for instance, whether you are being monitored, what records are held about your inquiries, or what information has been shared about you with third parties.

Key differences: SAR vs FOI at a glance

When a journalist should use a SAR

A SAR is the right tool when the investigation centres on your own personal data — specifically, what an organisation has recorded, shared, or acted upon in relation to you. Common scenarios include:

• 1Discovering what personal data an organisation holds about you — emails, call logs, internal notes, or surveillance records.
• 2Finding out whether you have been subjected to monitoring, profiling, or background checks by a public body or private company.
• 3Revealing the sources of information an organisation used when making a decision that affected you — for example, a rejection of accreditation or a police interaction.
• 4Understanding whether your data has been shared with third parties, including other government departments, contractors, or foreign agencies.
• 5Obtaining copies of correspondence in which you are named or discussed, which the organisation may not have disclosed via FOI.
• 6Investigating how long an organisation has retained your data and whether that retention is lawful.

When a journalist should use an FOI request

An FOI request is the right tool when you are seeking information held by a public authority about a matter of public interest — regardless of whether that information relates to you personally. FOI covers a far broader range of material than a SAR, but it only applies to public bodies. Use FOI to obtain:

• 1Policies, internal guidance, and decision-making processes within government departments, councils, NHS trusts, or police forces.
• 2Spending data, contracts, procurement decisions, and supplier payments.
• 3Correspondence between officials and external parties on matters of public concern.
• 4Statistical data, research, risk assessments, and internal audits.
• 5Information about third parties — for instance, how many complaints a body has received or how it has handled a particular category of case.
• 6Records relating to a public authority's own conduct — disciplinary proceedings, legal costs, settlement agreements.

For a step-by-step guide to making an FOI request, see our guide on how to file an FOI request in the UK.

The DPA 2018 journalism exemption and SARs

Schedule 2, Part 5 of the Data Protection Act 2018 creates a special exemption from certain UK GDPR obligations — including the right of access — where personal data is processed for journalistic, academic, artistic, or literary purposes. This exemption can be relied upon where complying with the data subject's rights would be incompatible with those purposes.

In practice, this means a media organisation or journalist may be able to refuse a SAR from a subject of their investigation where disclosing the data held would, for example, reveal a confidential source, prejudice the publication of an investigation, or undermine the journalistic purpose. However, the exemption is not absolute: the organisation must still consider each request individually and cannot use the exemption as a blanket refusal policy.

The exemption cuts both ways. Just as a journalist may use it to withhold data from a subject, an organisation being investigated may attempt to invoke it to refuse a SAR made by a journalist about data the organisation holds about them. In that scenario, the organisation would need to demonstrate that it is genuinely processing the data for a journalistic purpose — not simply using the exemption to avoid transparency.

For a fuller treatment, see our guide to the data protection journalism exemption.

Identity verification pitfalls for SARs

Unlike FOI requests — where anyone may submit a request anonymously — SARs require the organisation to be confident it is responding to the correct data subject. Organisations may legitimately ask for proof of identity before responding. However, the ICO makes clear that what is “reasonable” depends on context: if you are already known to the organisation and your identity is not genuinely in doubt, demanding extensive documentation is unlikely to be justified.

Common pitfalls to be aware of:

• ›Organisations using identity verification as a delay tactic — they must respond within one month of receiving sufficient information to identify you, not from the date of a later identity check.
• ›Requests for disproportionate documentation — a name and account reference is typically sufficient where the organisation already holds records about you; demanding a passport copy may not be reasonable.
• ›Organisations conflating identity verification with asking for a reason — you are never required to explain why you are making a SAR.
• ›The one-month clock pausing while the organisation seeks clarification — this pause is permissible but only where the request is genuinely unclear, not to buy extra time.
• ›If you believe identity verification is being used in bad faith, note this in your correspondence and raise it in any subsequent ICO complaint.

Checklist: SAR or FOI for your investigation?

Work through these questions to decide which route — or combination of routes — is right for your investigation:

The two routes are not mutually exclusive. A journalist investigating a public body's conduct may file an FOI request for policy documents and a SAR to discover what data the body holds about them personally. Both can be submitted simultaneously.

Frequently asked questions