With this document you can:

This box is not visible in the printed version.

How to make a subject access request

Information published under the Freedom of Information act on how to make a Subject Access Request (SAR).

Published: 23 September 2020

Last updated: 1 November 2022

This version was printed or saved on: 6 December 2023

Online version: https://www.gamblingcommission.gov.uk/contact-us/guide/how-to-make-a-subject-access-request

Overview: You have a right to ask us whether we are using or storing your personal data. This is called the right of access. It is commonly known as making a subject access request or SAR.

You can make a subject access request to find out:

You can make a subject access request verbally or in writing.

What we ask for

You’ll need to provide the following when making a SAR:

Documents you must provide

Do not send original documents. Photocopies are accepted.

You’ll need to provide:

Why we ask for this

We ask for this information so we can:

We will also use these details in any subsequent complaints into the handling or outcome of a request.

If you do not provide the information we need, we will not be able to process your request. This is so we can comply with our obligations under the General Data Protection Regulations (2016) (GDPR) (opens in new tab) and Data Protection Act (2018) (opens in new tab).

The legal basis for asking for this information is outlined in article 6(1)(C) (opens in new tab) of the GDPR.

When you’ll get a response

You’ll normally get a response from us within one month. If the request is complex, it might take up to three months.

Will I receive all the information I request?

Your right of access only allows you to receive your own personal data, subject to certain exemptions.

The Data Protection Act doesn’t provide rights to access information about our organisation’s:

It also doesn't allow you a right of access to documents, but we may provide you with a redacted copy if possible.

What if I am unhappy with the reply?

The Information Commissioner’s Office (ICO) is responsible for making sure that organisations behave in accordance with the Data Protection Act.

If you’re not happy with our reply, you should request an internal review from us at the Gambling Commission. Someone who was not involved in the original response will look at your case then give you a decision. The ICO website has guidance on contacting an organisation if you’re not happy with a reply (opens in a new tab).

After this step, if you’re still not happy you can complain directly to the ICO (opens in a new tab). The ICO will investigate your complaint further.

How we handle subject access requests

Your request for information will be logged and stored in our electronic filing system. Each case file includes the original request, information you've provided to us and any other information relevant to the request.

We may share the details of your request between our internal departments, depending on the subject matter.

If you are making a request for your personal data (or acting on behalf of someone making a request), you’ll need to provide proof of identity. If it's relevant, we'll also ask for information to show you have authority to act on someone else's behalf.

If your request is about information we’ve received from another organisation, we’ll ask the relevant organisation for their view on whether we can disclose the material.

How long we hold your details for

The retention period is set at 3 years plus the current calendar year. All information is held in line with the our retention schedule.

Why we keep requests

We keep details of requests to compile statistical reports on performance. We also use them for staff training and development.

Sharing of personal data

We may share your personal data with the Information Commissioner's Office (ICO) as the supervisory authority when required.

Your rights

If you want to know more about your rights, please refer to the Your Rights section in our privacy statement.

Make a subject access request

When you send your request, include:

We’d recommend reading the ICO’s guidance on preparing and submitting your request (opens in a new tab).

Once we’ve reviewed your request, we’ll ask you to provide ID for the person the request is about. If the request is on behalf of someone else, you’ll also need the appropriate consent.

Your request won’t be processed until we receive this information.

You can make a subject access request in one of the following ways:

Online form

Use our online form to make a request online.



In writing

Information Management Team
Gambling Commission
Victoria Square House
B2 4BP


If you’d prefer to make your request verbally, you can contact us by phone.

Telephone: 0121 230 6666.

Performance data

We publish data on the number of requests we receive and the outcomes of responses.

You can find subject access request data in the publication scheme section of the website.