A subject access request (SAR) is a request to see what personal data an organisation holds about you under UK GDPR Article 15. The response must include a copy of the data plus information on purposes, recipients, retention, and automated decisions. The ICO requires a reply within one calendar month, extendable by two for complex requests. The first copy is free; refusal or a fee is only allowed for manifestly unfounded or excessive requests — and the ICO sets that bar high. SARs are common in UK employment disputes. Failures can attract ICO fines up to £17.5 million or 4% of global turnover.