General
Pro Tips
How to Complain to the ICO If a Company Ignores Your Subject Access Request
Jun 13, 2024
A Subject Access Request (SAR) is a legal right under the UK General Data Protection Regulation (UK GDPR).
It allows you to request all personal data that an organisation holds about you — and they must respond within one month.
But many people find that companies, debt collectors, parking firms or solicitors simply ignore their request, delay responding, or provide incomplete data.
If this happens to you, you can complain to the Information Commissioner’s Office (ICO), which has the power to investigate and take action.In this article, we’ll explain exactly how to do that.
So What
What is the legal requirement?
Under Article 15 UK GDPR, you have the right to access your personal data.
An organisation must:
Respond to your SAR within one month
Provide all personal data they hold about you
Explain how they use your data and who they share it with
If they fail to respond — or give an incomplete response — you can escalate the matter to the ICO.
Why does this matter if you are challenging a CCJ?
If you are challenging a County Court Judgment (CCJ), a Subject Access Request can help you obtain key evidence:
Whether the claim was sent to the correct address
What the creditor knew about your case
Internal notes or correspondence that may support a set aside application
If your SAR is ignored, you risk losing important evidence. That’s why following up with an ICO complaint is so important.
Common reasons to complain to the ICO
You can complain if:
You received no response to your SAR within one month
The company asked for unnecessary ID and delayed the process
You received an incomplete or evasive response
The organisation refused to comply without a valid reason
How to complain to the ICO
Wait one calendar month from your original SAR.
If you sent your SAR on 1 June, you should expect a full response by 1 July.If you haven’t received a proper response:
Send a short reminder email to the organisation, giving them 7 days to comply.
Example wording:
“I am following up on my Subject Access Request sent on [date], which is now overdue. If I do not receive a full response within 7 days, I will be making a formal complaint to the Information Commissioner’s Office.”
3. If you still do not receive a response (or receive an inadequate one), submit a complaint to the ICO:
https://ico.org.uk/make-a-complaint/your-personal-information-concerns/
4. Provide:
A copy of your original SAR
Evidence of the organisation’s failure to comply
Any follow-up correspondence
A clear statement of what has happened and why you are complaining
What happens after you complain?
The ICO will review your complaint. They may:
Contact the organisation and require them to comply
Issue guidance or warnings
Take enforcement action in serious cases
Most companies will respond quickly once the ICO becomes involved.
Now What
If you are using a Subject Access Request as part of challenging a CCJ — or simply want to ensure your data rights are respected — don’t let companies ignore your request.
Next steps:
Check whether one month has passed since your SAR
If so, send a short reminder email
If they still do not respond or comply, submit an ICO complain
Keep copies of everything — this may support your set aside application if you are challenging a CCJ
If you need help understanding how a SAR fits into your CCJ case, see our full guide:
Subject Access Request: How to Use It to Challenge a CCJ
Useful Links:
Subject Access Request: How to Use It to Challenge a CCJ
Final tip: If you don’t enforce your rights, many organisations will simply ignore your Subject Access Request. The ICO is there to help — use it.