How to Make a Subject Access Request to the Home Office

Making a Subject Access Request to the Home Office

The UK Home Office holds extensive personal data about millions of people — immigration records, visa applications, asylum case files, biometric data, enforcement records, and correspondence. If you need to see what data the Home Office holds about you, a subject access request (SAR) is the legal mechanism to obtain it.

Home Office SARs are among the most common subject access requests made in the UK. They are also among the most complex to navigate, with long processing times and specific documentation requirements. This guide walks through the process from start to finish.

What Information Does the Home Office Hold?

The Home Office processes and stores personal data across its immigration, asylum, enforcement, and border functions. Depending on your history with the Home Office, they may hold some or all of the following:

Immigration and visa records: Applications for visas, leave to remain, indefinite leave to remain (ILR), and citizenship. This includes the application forms you submitted, supporting documents you provided, decision letters, and internal case notes made by caseworkers.

Asylum records: Asylum applications, screening interview records, substantive interview transcripts, country information used in your case, and decision letters including reasons for refusal or grant.

Biometric data: Fingerprints, facial images, and iris scans collected as part of visa applications, asylum claims, or enforcement encounters.

Enforcement records: Records of immigration enforcement actions, detention records, removal directions, reporting conditions, bail records, and any associated correspondence.

Correspondence: Letters, emails, and other communications between you (or your legal representatives) and the Home Office, as well as internal correspondence about your case.

Travel records: Entry and exit data, passenger information collected at borders, and advance passenger information provided by airlines.

Caseworker notes and internal assessments: Notes made by Home Office staff about your case, assessments of your circumstances, and recommendations made internally. These are personal data and should be included in a SAR response, though the Home Office may redact certain information under specific exemptions.

Step-by-Step Guide to Submitting Your SAR

Step 1: Decide How to Submit

The Home Office accepts subject access requests through its online form and by post.

Online submission (recommended): The Home Office provides an online SAR form through GOV.UK. This is the fastest way to submit and creates an immediate record of your request. Search for "subject access request Home Office" on GOV.UK to find the current form.

Postal submission: You can submit a written request by post to the Home Office's Data Protection Team. The current postal address is published on the GOV.UK website. If submitting by post, use recorded delivery so you have proof of the date the request was received.

Step 2: Provide Your Personal Details

Your request must include enough information for the Home Office to identify you in their systems. At a minimum, provide:

• Full name (including any previous names you have used)
• Date of birth
• Nationality
• Home Office reference number (if you have one — this is the most important identifier for locating your records)
• Contact address for the response
• Port reference number (if applicable, for border-related records)

If you have had multiple interactions with the Home Office under different names or reference numbers, include all of them. The more identifying information you provide, the more complete the search will be.

Step 3: Specify What You Are Looking For

You are entitled to all personal data the Home Office holds about you, and you do not need to narrow your request. However, specifying what you are most interested in can help the Home Office prioritize their response.

Common categories people request include:

• All records related to a specific visa or immigration application
• Asylum interview transcripts and case notes
• Enforcement and detention records
• Internal caseworker notes and decision rationale
• Correspondence between the Home Office and third parties about your case
• Biometric data held about you

If you want everything, say so clearly. If you have a specific focus, mention it — but make clear that you are not limiting your request to only that category.

Step 4: Provide Identity Documents

The Home Office requires proof of identity before releasing personal data. You will typically need to provide:

• A copy of your passport (the photo page) or other government-issued photo identification
• Proof of your current address (a utility bill or bank statement dated within the last three months)

If you are submitting on behalf of someone else — for example, as a legal representative — you will also need:

• Written authority from the data subject authorizing you to act on their behalf
• Your own identification as the representative
• Evidence of your professional status (for example, a letter from your law firm confirming you represent the individual)

If you are unable to provide standard identity documents (for example, because your passport is held by the Home Office), explain this in your request and provide whatever alternative identification you can. The Home Office should take a proportionate approach to verification.

Step 5: Submit and Record the Date

Submit your request and record the exact date of submission. The one-month deadline for the Home Office's response starts from the date they receive your request. If you submit online, the submission timestamp serves as your receipt. If you submit by post, the date recorded delivery is signed for is your evidence.

Expected Timelines

Under the UK GDPR, the Home Office must respond to your SAR within one calendar month of receiving it. For complex requests, they can extend the deadline by up to two additional months (three months total), but they must notify you of the extension within the first month and explain why it is needed.

The Reality

In practice, Home Office SAR responses frequently take longer than one month. The volume of requests is high, the records are often spread across multiple systems, and immigration case files can be extensive. The Home Office has acknowledged backlogs in SAR processing in previous ICO assessments.

This does not mean you should accept delays without question. If you have not received a response or an extension notification within one month, you have grounds to escalate.

Partial Responses

The Home Office sometimes provides responses in stages, particularly for large or complex requests. You may receive a partial disclosure with a commitment to provide the remainder by a specified date. While this is not ideal, it is a pragmatic approach when the volume of data is genuinely large.

What to Do If the Response Is Delayed

Follow Up With the Home Office

If one month has passed and you have not received a response or an extension notice, write to the Home Office Data Protection Team. Reference your original request, provide the date of submission, and ask for an update on the status of your request and an expected completion date.

Complain to the ICO

If the Home Office does not respond to your follow-up, or if the delay is excessive, you can complain to the Information Commissioner's Office (ICO). The ICO has the authority to investigate and, if necessary, order the Home Office to comply.

To complain to the ICO:

1. Visit the ICO website and use the online complaints form
2. Provide details of your original SAR (date submitted, what you requested, the Home Office reference if you have one)
3. Explain what response you have received (or that you have received nothing)
4. Include copies of any correspondence with the Home Office

The ICO will typically contact the Home Office on your behalf and attempt to resolve the matter. In many cases, an ICO complaint prompts the Home Office to prioritize the outstanding response.

Seek Legal Advice

If your SAR relates to an active immigration case and the delay is affecting your ability to prepare for a hearing, appeal, or other legal proceeding, seek advice from an immigration solicitor. They may be able to apply additional pressure through legal channels, including pre-action correspondence or an application to the court for an order compelling disclosure.

Understanding the Response

When you receive your SAR response, it should include:

A copy of your personal data. This is the core of the response — the actual records the Home Office holds about you. Expect a substantial document package for any case with a significant history.

Supplementary information. Under Article 15 of the UK GDPR, the Home Office must also tell you the purposes of processing, categories of data held, recipients the data has been shared with, retention periods, and your rights.

Redactions. The Home Office will likely redact some information from the response. Common redactions include:

• Third-party personal data (names and details of other individuals mentioned in your case records)
• Information that is subject to a national security exemption
• Information where disclosure would prejudice immigration control (under Section 31 of the Data Protection Act 2018)
• Information subject to legal professional privilege

Each redaction should be noted and the exemption relied upon should be identified. If the response is heavily redacted without clear justification, this is a potential ground for complaint.

Exemptions the Home Office Commonly Relies On

The Home Office regularly applies certain exemptions when responding to SARs:

Immigration control exemption (DPA 2018, Schedule 2, Paragraph 4). The Home Office can withhold personal data where disclosure would be likely to prejudice the maintenance of effective immigration control. This is a broad exemption that the Home Office applies frequently. However, it must be applied on a case-by-case basis to specific data — it is not a blanket right to withhold everything immigration-related.

National security (DPA 2018, Section 26). Data can be withheld where disclosure would prejudice national security. This is subject to a ministerial certificate.

Crime prevention and detection (DPA 2018, Schedule 2, Paragraph 2). Data can be withheld where disclosure would prejudice the prevention or detection of crime.

Third-party data. As with any SAR, the Home Office must redact personal data about other identifiable individuals unless consent has been obtained or disclosure is reasonable.

If you believe an exemption has been applied incorrectly or too broadly, you can challenge this through the ICO complaints process or through the courts.

Common Reasons People Make Home Office SARs

Understanding why people typically request their data can help you decide whether a SAR is the right step for your situation.

Preparing for an appeal or judicial review. Accessing your case file, including internal caseworker notes, can reveal the reasoning behind a decision and identify any errors or unfairness that might support an appeal.

Checking the accuracy of records. If you believe the Home Office holds incorrect information about you — for example, wrong dates, incorrect nationality, or inaccurate records of your immigration history — a SAR allows you to see exactly what they have on file and request corrections.

Understanding a decision. If you received a refusal or an unfavorable decision and the decision letter does not fully explain the reasoning, the internal case notes obtained through a SAR may provide more detail.

Preparing for a new application. Before submitting a new visa or leave to remain application, reviewing your existing Home Office records helps ensure consistency and allows you to address any discrepancies.

Windrush and historical immigration cases. Individuals affected by the Windrush scandal or other historical immigration cases may use SARs to obtain records that evidence their immigration history and right to remain.

Tips for a Successful Request

Be thorough with your identifiers. The more reference numbers, names, and dates you can provide, the more complete the search will be. The Home Office's systems are not always well-integrated, and records under different reference numbers may not be linked automatically.

Keep copies of everything. Copy your submission, any correspondence, and the date of submission. If you need to escalate, this documentation is essential.

Be patient but persistent. Home Office SARs often take longer than the legal deadline. Follow up politely but firmly. Escalate to the ICO if the delay becomes unreasonable.

Read the response carefully. Check that the response covers all the categories of data you expected. If records are missing or sections appear incomplete, follow up and ask whether additional searches are needed.

Seek professional help if needed. If your SAR relates to a live legal matter, an immigration solicitor can help you submit the request, interpret the response, and take action based on what you find.

References

• UK GDPR Article 15: Right of access by the data subject. GDPR Article 15
• Data Protection Act 2018: Schedule 2 — exemptions, including immigration control. UK DPA 2018
• GOV.UK: Home Office subject access request guidance. GOV.UK Home Office SAR
• ICO: Making a complaint about a data protection issue. ICO complaints

Related Guides

• What Is a Subject Access Request? — the fundamentals of SARs
• DSAR Response Deadlines — deadlines across all jurisdictions
• DSAR Breach Compensation — what to do when responses are late