Which subject access request template do you need?

No, and there is no form you have to use. The UK GDPR sets no formality requirements for a request under Article 15, so a plain email is as valid as a formal letter. What a good template gives you is not legal effect but scope: a request that identifies you clearly, says what it is, and states what you want with a date range is far less likely to trigger a clarification request, and since 5 February 2026 a clarification request can pause your own deadline under Article 12A(5).

One month, but from the relevant time rather than from the day you sent it. Article 12A(1) sets the applicable time period as one month beginning with the relevant time, and Article 12A(2) defines that as the latest of three dates: when the controller receives the request, when it receives any identity information it asked for, and when any fee it charged is paid. It may extend by two further months for the complexity or number of requests, but under Article 12A(4) notice of that must be given inside the first month and must state the reasons.

Yes, since 5 February 2026, in one specific circumstance. Article 12A(5) provides that where a controller reasonably requires further information in order to identify the information or processing activities to which an Article 15 request relates, the period from the day it asks to the day it receives your answer does not count towards the deadline. It pauses rather than restarts. The power is limited to identifying what the request relates to: a question about why you want the data does not engage it.

No, in the ordinary case. Article 12(5) makes the response free of charge. A fee is only available where the request is manifestly unfounded or excessive, in particular because of its repetitive character, and the same provision states that the controller bears the burden of demonstrating that character. Separately, Article 15(3) allows a reasonable fee based on administrative costs for further copies of data already provided, which is a different thing from charging for the request itself.

Not under the UK GDPR. Section 3(2) of the Data Protection Act 2018 defines personal data as information relating to an identified or identifiable living individual, so information about someone who has died is not personal data for these purposes. Other routes exist depending on what you need: the Access to Health Records Act 1990 for a deceased person's health records, the Freedom of Information Act 2000 for records held by a public authority, and the executor's ordinary entitlement to the estate's papers. Correspondence between you and the person who died is your own personal data and remains in scope.

Specific things, not the request as a whole. Confidential references are exempt under Schedule 2 paragraph 24 of the Data Protection Act 2018, and the exemption follows the reference whichever organisation holds the copy. Material covered by legal professional privilege is exempt. Article 15(4) allows information to be withheld or redacted where providing it would adversely affect the rights and freedoms of others, which is where colleagues' details are removed. None of those is a reason to refuse the request itself, and Article 12(4) requires the controller to state its reasons where it does not act.

Article 12(4) requires a controller that does not act on a request to tell you the reasons, and to tell you about three routes: making a complaint to the controller itself under section 164A of the Data Protection Act 2018, complaining to the Information Commissioner under section 165 of that Act, and seeking a judicial remedy. Silence fails that duty on its own terms. Use the complaint to the controller first: it is quick, it creates a dated record, and the regulator will ask whether you did.