What to request

A Subject Access Request reveals exactly what data is held about you. For CIFAS marker cases, you should submit SARs to both the filing organisation and to CIFAS directly. The responses will reveal the evidence base and any gaps in the institution's case.

How to submit

• Write to the institution's Data Protection Officer
• State clearly that this is a Subject Access Request under Article 15 of UK GDPR
• Request all personal data held about you, including the CIFAS marker data, evidence relied upon, internal notes, and correspondence
• Submit to CIFAS directly as well — request your full NFD record
• Keep proof of submission and the date

The 30-day deadline

The institution must respond within 30 calendar days. If they fail to respond, this is a GDPR breach that can be reported to the ICO. The failure to respond also strengthens any future court claim for damages.

This is why we recommend submitting the SAR at the same time as the complaint — it runs a parallel clock that creates additional pressure.