How to Make a Subject Access Request to HMRC

Your Right to See What HMRC Knows About You

HM Revenue and Customs holds a significant amount of personal data about individuals in the United Kingdom. Tax returns, PAYE records, National Insurance contributions, tax credit information, benefits data, correspondence, and notes from phone calls — HMRC collects and retains personal information across a wide range of interactions.

Under the UK GDPR and the Data Protection Act 2018, you have the right to request a copy of the personal data HMRC holds about you. This is a subject access request (SAR). HMRC must respond within one calendar month. This guide covers how to submit your request, what to expect, and what to do if things do not go smoothly.

What Data Does HMRC Hold?

HMRC may hold personal data across multiple systems and categories. Depending on your circumstances, this could include:

Tax and Income Data

• Self Assessment records — tax returns, calculations, statements of account, and correspondence
• PAYE records — employment information received from employers, pay details, tax codes, and coding notices
• National Insurance (NI) records — contribution history, NI number assignment records
• Capital Gains Tax records — disposal information, calculations
• VAT records (if registered for VAT) — returns, assessments, correspondence

Benefits and Credits

• Tax credits — claims, awards, renewals, overpayment recovery
• Child Benefit — claims, payments, High Income Child Benefit Charge records
• Universal Credit interactions — where HMRC shares data with DWP

Communication Records

• Correspondence — letters sent to and received from you
• Phone call notes — records of calls to HMRC helplines (and in some cases, recordings)
• Online account activity — records of your interactions through your Personal Tax Account or HMRC app
• Webchat transcripts — if you have used HMRC's online chat service

Compliance and Investigation Records

• Enquiry records — if HMRC has opened or conducted an enquiry into your tax affairs
• Compliance check records — notes, correspondence, and decisions
• Penalty records — details of any penalties issued and related correspondence
• Debt management records — if you have outstanding tax debts

Other Records

• Agent authorization records — if you have appointed a tax agent
• Marriage Allowance records — transfer of allowance between partners
• Student loan repayment information — data shared with the Student Loans Company

How to Submit Your Request

HMRC accepts subject access requests through several channels.

Online (Recommended)

The most efficient method is to submit your request through the HMRC online form on GOV.UK. Search for "subject access request HMRC" on GOV.UK to find the current form. The online route is HMRC's preferred channel and typically results in faster processing.

When submitting online, you will need to provide:

• Your full name (and any previous names if your records may be under a different name)
• Your National Insurance number
• Your Unique Taxpayer Reference (UTR) if you have one
• Your date of birth
• Your current address
• Details of what information you are requesting — be as specific as possible

By Post

You can write to HMRC's Data Protection Officer:

HMRC Data Protection Officer HM Revenue and Customs 14 Westfield Avenue Stratford London E20 1HZ

Your letter should include the same identifying details listed above. Send it by recorded delivery so you have proof of the date HMRC received your request.

By Phone

You can call HMRC to make a verbal SAR. However, HMRC will likely ask you to follow up in writing or direct you to the online form. A verbal request is valid and starts the clock, but providing details in writing ensures clarity about what you are requesting.

What ID Is Required?

HMRC needs to verify your identity before releasing personal data. The level of verification depends on how you submit your request:

Online submission: If you submit through GOV.UK while logged into your Government Gateway account, your identity is already verified through the Gateway authentication process. This is the simplest approach.

Postal submission: If you write to HMRC and they cannot verify your identity from the information you provide (name, NI number, UTR, date of birth, address), they may ask for additional verification. This could include a copy of your passport or driving license, or a recent utility bill or bank statement confirming your address.

Third-party requests: If someone is making a request on your behalf (a solicitor, accountant, or family member), HMRC will require written authorization from you. This should be a signed letter confirming the person's identity and authorizing them to receive your personal data. If the request is from a legal representative, they should provide evidence of their authority to act (e.g., a signed letter of authority, power of attorney, or grant of probate for deceased persons' records).

Do not send original documents. Send copies and retain the originals.

What to Include in Your Request

The more specific your request, the faster and more useful the response will be. HMRC holds data across many systems, and a vague request ("send me everything you have about me") may take longer to process than a targeted one.

Consider specifying:

• The type of data you are looking for (e.g., PAYE records, Self Assessment returns, phone call notes, penalty correspondence)
• The time period you are interested in (e.g., tax years 2022/23 to 2024/25)
• Specific interactions you want records of (e.g., "records of all phone calls I made to the Self Assessment helpline between January and March 2025")

You are not required to narrow your request — you have the right to all your personal data — but specificity helps HMRC process the request efficiently and increases the likelihood you will receive exactly what you need.

Expected Timelines

Under the UK GDPR, HMRC must respond to your SAR within one calendar month of receiving the request. If they need to verify your identity and request additional information, the clock starts from the date they receive the verification, not the date of the original request.

In practice, HMRC response times can vary:

Simple requests (specific data types, limited time periods): Often processed within the one-month deadline without issue.

Complex or broad requests (all data, multiple tax types, extensive time periods): HMRC may invoke the right to extend the deadline by up to two additional months under UK GDPR Article 12(3). If they do, they must notify you within the first month and explain why the extension is needed.

Backlog periods: HMRC handles a large volume of SARs. During busy periods, delays beyond the statutory deadline are not uncommon. This does not excuse the delay, but it is the reality.

HMRC will typically send an acknowledgment when your request is received. If you do not receive an acknowledgment within two weeks of submitting your request, follow up to confirm it was received.

What to Do If Your Request Is Refused

HMRC can refuse or partially refuse your request only on specific legal grounds. Common reasons include:

Crime and taxation exemption (DPA 2018 Schedule 2, Part 1, Paragraph 2): HMRC can withhold data if disclosing it would be likely to prejudice the prevention or detection of crime, or the assessment or collection of any tax or duty. This is the exemption HMRC relies on most frequently. It must be applied on a case-by-case basis — HMRC cannot use it as a blanket refusal.

Legal professional privilege: Correspondence between HMRC and its lawyers that is subject to legal privilege may be withheld.

Third-party data: Information about other individuals contained in your records may be redacted to protect their privacy.

Manifestly unfounded or excessive requests: Under UK GDPR Article 12(5), HMRC can refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive. This is a high bar and is rarely relied on for standard SARs.

If You Disagree With a Refusal

1. Ask HMRC to review the decision. Contact HMRC's Data Protection Officer and request an internal review. Explain why you believe the refusal is unjustified and ask for a detailed explanation of which exemption was applied and why.

2. Complain to the ICO. If HMRC does not resolve the issue, you can complain to the Information Commissioner's Office. The ICO can investigate and, if appropriate, order HMRC to comply. You can submit a complaint through the ICO's website. The ICO generally expects you to have attempted to resolve the issue with HMRC first.

3. Apply to the court. Under Section 167 of the Data Protection Act 2018, you can apply to a court for an order requiring HMRC to comply with the UK GDPR. This is a last resort and typically involves legal costs, but it is available if the ICO route does not resolve the matter.

If Your Request Is Delayed

If HMRC has not responded within the one-month deadline (or the extended deadline, if an extension was communicated):

1. Send a follow-up — write to HMRC's Data Protection Officer noting the date of your original request and the deadline. Ask for an immediate response or a clear explanation of the delay.

2. Complain to the ICO — if HMRC does not respond to your follow-up, report the delay to the ICO. Late responses are a breach of the UK GDPR, and the ICO can intervene.

After You Receive Your Data

Review the data HMRC provides. If you believe any of it is inaccurate, you have the right to request rectification under UK GDPR Article 16. Contact HMRC with specific details of what you believe is wrong and what the correct information should be.

If you believe data has been retained beyond its lawful retention period, you can request erasure under Article 17, though HMRC will likely rely on legal obligation exemptions for most tax records, which must be retained for statutory periods.

Related Guides

• Subject Access Request to the Home Office — SAR process for immigration and passport records
• Subject Access Request Form — general SAR form template
• DSAR Response Deadlines — deadlines across jurisdictions

References

• UK GDPR: Article 15 — Right of access. UK GDPR Article 15
• Data Protection Act 2018: Schedule 2 — exemptions. DPA 2018
• HMRC SAR guidance: GOV.UK
• ICO: Making a subject access request. ICO guidance