🔐
Data protection / SAR letter
To: The organisation's Data Protection Officer
Timeline: UK GDPR requires a response within 1 month. ICO complaints are investigated within 3 months.Outcomes: ICO investigates 70%+ of complaints where the organisation has failed to respond within 1 month
Deadline / timing: Organisation must respond within 1 calendar month of receiving request (UK GDPR Art.12). ICO complaint: within 3 months of last substantive contact.
Filing instructions →Your first letter is free. No card, no signup required.
Tell us about your situation
We ask only what we need to draft the right letter. Approximately 3 minutes.
What this letter will cite
- UK GDPR Art.17 — Right to request erasure ("right to be forgotten") of personal data in defined circumstances.
- UK GDPR Art.15 — Right to request a copy of personal data held by an organisation within 1 month. Subject Access Request (SAR).
- DPA 2018 — UK implementing statute for UK GDPR. ICO is the supervisory authority; complaints must be lodged within 3 months of last substantive contact.
- UK GDPR Art.77 — Right to complain to the ICO if data subject rights are not respected. ICO can issue enforcement notices and fines.
AEQUARA UK provides AI-assisted self-help correspondence — not legal advice. For high-stakes disputes, court proceedings, or matters requiring legal representation, consult a qualified solicitor. Citizens Advice: 0800 144 8848 · Law Society Solicitor Finder: solicitors.lawsociety.org.uk