Ask and You Shall Receive a Zip File: Twenty UK Apps Meet the Subject Access Request
You can ask almost any organisation in the UK for a copy of the personal data it holds about you. It is called a subject access request, it is usually free, and the law says you should hear back within a month. Most people never try it. We wanted to know what the answer actually looks like when the organisation in question is an app on your phone rather than a bank branch with a filing cabinet.
So we picked twenty services we use anyway — banking, groceries, trains, parking, streaming, fitness, dating, energy, a gym, a photo printer — and sent each one the same request on the same Monday in September. Same wording, same email address as the account, same polite tone. Then we logged the reply time, the format and whether the result told us anything useful about our own lives.
The ground rules
Under Article 15 of the UK GDPR you are entitled to a copy of your personal data, plus a set of supporting details: why it is held, what categories exist, who it has been shared with, how long it is kept, where it came from if not from you, and whether it has been sent abroad. That second list is the bit almost everyone forgets, including, it turns out, most apps.
The statutory clock is one month. It can be extended by two more months for genuinely complex requests, but you should be told that inside the first month. No fee, unless the request is manifestly unfounded or excessive, which twenty polite emails are not.
The scoreboard
| What we asked | First reply | Format | Overall |
|---|---|---|---|
| High-street banking app | 6 days | PDF + CSV | Good |
| Supermarket loyalty app | 29 days | zip of CSVs | Patchy |
| Rail ticketing app | 12 days | Good | |
| Parking app | 41 days | Word doc of screenshots | Poor |
| Streaming service | 4 days | JSON | Good |
| Fitness tracking app | 8 days | CSV | Patchy |
| Food delivery app | 30 days | zip of 11 CSVs | Poor |
| Dating app | 3 days | Good | |
| Energy supplier app | 20 days | Good | |
| Mobile network app | 27 days | CSV | Patchy |
| Hotel chain app | 15 days | Good | |
| Airline app | 38 days | Patchy | |
| Pharmacy app | 9 days | Good | |
| Car insurance app | 14 days | Good | |
| Coffee loyalty app | 25 days | Patchy | |
| Bookmaker app | 5 days | CSV | Good |
| Donation app | 18 days | Good | |
| Gym chain app | 31 days | Patchy | |
| Photo printing app | 7 days | zip of JPEGs | Good |
| Broadband provider app | 22 days | CSV | Patchy |
Fourteen of the twenty replied inside a month. Two needed a chase and one blew straight past the deadline without a word. The fastest was a dating app at three days, which is either excellent governance or a team that has done this many times before. The slowest was the parking app, which eventually sent a Word document containing screenshots of a web portal, as though the data had been photographed through a window.
Three ways it goes wrong
The download-my-data decoy. Several apps pointed us at their self-service export button instead of answering the request. That tool is useful, but it is not the same thing. It tends to give you the data the company finds easy to export, not the data you asked for. One supermarket's export contained a year of transactions and nothing else: no support chats, no device identifiers, no explanation of what the store codes meant.
The mystery zip. Eleven CSV files with names like dataset_04_final.csv and column headers such as attr_17 are technically a copy of your personal data. They are not, in any meaningful sense, transparent. The best responses included a one-page key explaining each field. Only four of the twenty bothered.
The silence, then the extension. Two organisations sent a holding email on day 28 to say they needed more time. That is allowed. What is not allowed is saying nothing at all, which is what happened with the parking app until we chased it a second time.
What good looks like
The high-street banking app was the clear winner. Six days, a readable PDF covering account details, transaction history, login records and the last four digits of the device, plus a short covering note listing the lawful basis, retention periods and the credit reference agencies it shares data with. No drama, no jargon, no solicitor.
The rail app and the pharmacy app were close behind. Both sent clean PDFs with a sentence at the top explaining what was included and what had been redacted because it belonged to somebody else. That small courtesy made the whole document twice as easy to read.
Do it yourself in two paragraphs
You do not need a template from a law firm. You need a clear request, sent from the email address on your account, with the words subject access request in the subject line. Something like this:
Please treat this as a subject access request under Article 15 of the UK GDPR. Please send me a copy of all personal data you hold about me, along with the information listed in Article 15(1): the purposes of processing, the categories of data, the recipients, the retention periods and the source of any data not collected from me. Please provide it in a structured, commonly used and machine-readable format, and include a short key explaining any spreadsheet columns. I am writing from the email address registered to my account. Please reply within one month.
That last line about the key is not a legal right in itself, but it is the single most effective sentence we included. Ask for it and you will often get it. Skip it and you will get attr_17.
If they go quiet
Chase once, in writing, quoting the date of your original email. If a month has passed with no substantive reply, you can complain to the Information Commissioner's Office through its website. It costs nothing and takes about ten minutes. The ICO will not act as your personal lawyer, but a complaint on file is a useful nudge, and several organisations suddenly find your email when the regulator's reference number appears in it.
Worth a morning
A subject access request is one of the few consumer rights that works exactly as advertised, most of the time, for free. It is also a strange experience: reading a spreadsheet of your own Tuesday evenings rendered as timestamps and store IDs. Do it once for the app you trust most and once for the one you trust least. The difference in the replies tells you more about the company than any privacy policy ever will.
Put a reminder in your calendar for this time next year. It takes less time than a supermarket shop, and unlike the shop, you come away with something you own.
