How to make a subject access request to HMRC | AccountingStack

Under the UK General Data Protection Regulation (UK GDPR), you can make a subject access request to HMRC by sending a written request with your full name, address, National Insurance number or Unique Taxpayer Reference, details of the information you want, and proof of identity, either by post to HMRC Subject Access Requests, HMRC BX9 1ZT, or through your Personal Tax Account or the GOV.UK contact form. This is called a Subject Access Request (SAR).

For UK taxpayers, including individuals and small business owners, it is a practical way to see what personal data HMRC holds, check that your tax records are accurate, and deal with HMRC on an informed basis. HMRC must usually respond within one month of receiving your request and provide a copy of the data held free of charge. This guide explains what a SAR is, what information HMRC may hold, how to submit the request, what you should receive back, the response times, what to do if HMRC refuses, and the other related data rights you can use.

What is a subject access request?

A subject access request is a formal request made under Article 15 of the UK GDPR. It gives you the right to know what personal data an organisation, including a government body like HMRC, holds about you, how it is being used, and who it has been shared with.

SARs are commonly used to verify what records HMRC holds before or during an investigation, to check whether contact information or employment history is accurate, or to understand why HMRC has made a particular decision about your tax position.

What personal data does HMRC hold?

HMRC holds a significant amount of data on most UK taxpayers, and while it may keep records going back many years, information for the last five years is often available more quickly online. This can include:

• Personal details: name, address, National Insurance number, date of birth

• Tax returns and supporting information submitted over many years

• PAYE records from employers and pension providers

• Bank interest and investment income reported by financial institutions

• Records of correspondence, phone calls, and decisions made about your account

• Information about penalties, enquiries, and payment history

• Data received from third parties, such as land registry or international tax bodies

For the current tax year and the previous five years, you may be able to view some records first through your Personal Tax Account, the hmrc app, or the income record viewer before making a formal request.

How to submit a SAR to HMRC

You can submit a subject access request to HMRC in writing. There is no official form required, but to make a subject access request that HMRC can treat as a valid subject access request, include:

• Your full name and address

• Your National Insurance number or Unique Taxpayer Reference

• A clear description of the data you are requesting, identifying the specific information you want and the relevant tax year or tax years

• Proof of identity (a copy of your passport or driving licence)

• If another person is making the request for you, you must give permission for that person to act on your behalf, such as a tax agent or trusted person

Send your SAR by post to: HMRC Subject Access Requests, HMRC BX9 1ZT. You can also contact HMRC online, by phone or by webchat to make or start a request, and you may be able to submit through your Personal Tax Account or via the GOV.UK contact form. Check the GOV.UK website for the most current submission method before applying. It can also help to include your reason for asking for the data so HMRC can route the request correctly.

What you will receive

HMRC will provide a copy of the personal data it holds, usually in digital format. It should also provide the personal information the organisation holds with other information required under data protection law about how that data is used and shared. This may include printouts of records, call logs summarising phone contacts, and notes from compliance reviews. You will not necessarily receive every internal document HMRC has ever created, as in certain circumstances it may withhold information relating to criminal investigations or tax collection, including disclosures involving law enforcement agencies or local authorities where an exemption applies, as well as information that is legally privileged.

How long HMRC has to respond

HMRC must respond to a SAR within one month of receipt of your verified request. Subject access requests are normally free for the person making one. If the request is complex or HMRC has received multiple requests from the same person, HMRC can extend the deadline by a further two months, but it must notify you of this within the first month. HMRC may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive.

What to do if HMRC refuses or delays

If HMRC does not respond within the legal timeframe, or refuses your request without adequate justification, you can escalate to the Information Commissioner's Office (ICO) at ico.org.uk. If you think the reply is incomplete or does not include all the information you asked for, contact HMRC first and ask it to review the response. The ICO is the UK's data protection regulator and can investigate complaints about HMRC's handling of personal data requests. You can also check the relevant GOV.UK page and ICO guidance for complaint routes and further information on how HMRC shares data. HMRC also has a data protection officer, and you can raise concerns there before or alongside complaining to the Information Commissioner's Office.

Other data rights with HMRC

In addition to the right of access, which sits under the UK GDPR and the Data Protection Act 2018, you have the right to:

• Rectification: Ask HMRC to correct inaccurate personal data it holds about you.

• Erasure: In limited circumstances, ask HMRC to delete certain data, though this is rarely applicable to tax records which HMRC is legally required to retain.

• Object to processing: Object to HMRC using your data in ways you believe are unlawful.

HMRC must handle personal information in line with data protection law, making sure the data it uses is relevant and limited to what is necessary, although some rights can be restricted in certain circumstances.

This can also include rules on automated decision making and safeguards where a decision has a significant effect on the person concerned.