Under the UK General Data Protection Regulation (UK GDPR), you have the right to request access to any personal data that HMRC holds about you. This is called a Subject Access Request (SAR). HMRC must respond within one month of receiving your request and provide a copy of the data held, free of charge.
What is a subject access request?
A subject access request is a formal request made under Article 15 of the UK GDPR. It gives you the right to know what personal data an organisation, including a government body like HMRC, holds about you, how it is being used, and who it has been shared with.
SARs are commonly used to verify what records HMRC holds before or during an investigation, to check whether contact information or employment history is accurate, or to understand why HMRC has made a particular decision about your tax position.
What personal data does HMRC hold?
HMRC holds a significant amount of data on most UK taxpayers. This can include:
- Personal details: name, address, National Insurance number, date of birth
- Tax returns and supporting information submitted over many years
- PAYE records from employers and pension providers
- Bank interest and investment income reported by financial institutions
- Records of correspondence, phone calls, and decisions made about your account
- Information about penalties, enquiries, and payment history
- Data received from third parties, such as land registry or international tax bodies
How to submit a SAR to HMRC
You can submit a subject access request to HMRC in writing. There is no official form required, but your request should include:
- Your full name and address
- Your National Insurance number or Unique Taxpayer Reference
- A clear description of the data you are requesting (you can request all data or limit it to a specific period or data type)
- Proof of identity (a copy of your passport or driving licence)
Send your SAR by post to: HMRC Subject Access Requests, HMRC BX9 1ZT. You may also be able to submit through the HMRC online account or via the GOV.UK contact form. Check the GOV.UK website for the most current submission method before applying.
What you will receive
HMRC will provide a copy of the personal data it holds, usually in digital format. This may include printouts of records, call logs summarising phone contacts, and notes from compliance reviews. You will not necessarily receive every internal document HMRC has ever created, as certain categories of data are exempt (for example, data relating to the prevention or detection of crime, or information that is legally privileged).
How long HMRC has to respond
HMRC must respond to a SAR within one month of receipt of your verified request. If the request is complex or you have made multiple requests, HMRC can extend the deadline by a further two months, but it must notify you of this within the first month.
What to do if HMRC refuses or delays
If HMRC does not respond within the legal timeframe, or refuses your request without adequate justification, you can escalate to the Information Commissioner's Office (ICO) at ico.org.uk. The ICO is the UK's data protection regulator and can investigate complaints about HMRC's handling of personal data requests.
Other data rights with HMRC
In addition to the right of access, you have the right to:
- Rectification: Ask HMRC to correct inaccurate personal data it holds about you.
- Erasure: In limited circumstances, ask HMRC to delete certain data, though this is rarely applicable to tax records which HMRC is legally required to retain.
- Object to processing: Object to HMRC using your data in ways you believe are unlawful.