How to Make a Subject Access Request to HMRC

If HMRC is investigating you, enquiring into your return or you simply want to know what is on your file, you have a legal right to ask for it. This is called a Data Subject Access Request, or DSAR, and it is one of the most under-used rights available to anyone dealing with HMRC. It is free, it does not require a solicitor and HMRC must normally respond within one month. This guide explains exactly what you can ask for, what HMRC is allowed to withhold and why, how long it takes and what to do if HMRC ignores you or refuses.

What Is a Subject Access Request?

A subject access request is a request made under Article 15 of the UK GDPR. It gives every individual the right to ask any organisation that holds information about them – a bank, an employer, a hospital or HMRC – to confirm whether it is processing their personal data and, if so, to provide a copy of it, along with some basic information about how and why it is being used.

HMRC is no exception. Despite its size and the sensitivity of much of what it holds, HMRC is bound by exactly the same data protection law as any other organisation, with a small number of specific, limited exemptions for tax and crime purposes, which we explain below. Outside those exemptions, you have the same right to your HMRC data as you would to your bank statements from your bank.

Why This Matters If HMRC Is Investigating You

If you are the subject of a tax enquiry, a Schedule 36 information notice, a COP9 investigation or you have received a discovery assessment, it is natural to focus entirely on responding to whatever HMRC has formally put to you. A subject access request works the other way around: instead of waiting for HMRC to tell you what it thinks, you ask HMRC to show you what it has actually written down internally.

This matters because HMRC’s internal case notes, risk assessments and officer commentary frequently contain more detail – and sometimes a different emphasis – than the formal letters and assessments you receive. A DSAR can reveal: what specifically triggered the enquiry (a third-party data match, a tip-off, an automated risk flag); how HMRC has internally characterised your behaviour (which matters enormously for penalty levels); and whether the timeline HMRC relies on for a discovery assessment is actually supported by its own internal records. None of this is visible from the outside without asking for it directly.

What You Can Ask HMRC For

You are entitled to ask for confirmation of whether HMRC holds personal data about you and a copy of that data, together with: the purposes for which it is being used; the categories of data involved; anyone HMRC has shared it with; how long HMRC intends to keep it; and, importantly, where the information did not come from you directly, where it came from.

In practice, for someone under enquiry or investigation, this commonly includes:

• Internal case notes recorded by the officer handling your case;
• Any risk score or classification applied to you, including outputs from HMRC’s Connect data-matching system;
• Notes recommending escalation – for example, a note suggesting your case be moved into COP9 or referred to HMRC’s Fraud Investigation Service;
• Internal commentary on your behaviour or credibility, including any assessment of whether your conduct is considered “careless” or “deliberate”;
• Third-party information HMRC has received about you – from banks, from other countries under international data-sharing agreements, from Land Registry or from informants;
• Records of any decision made about your case and the stated reasoning behind it;
• Notes or recordings of any phone calls you or your adviser have had with HMRC.

The more specific you are about what you are asking for, the better your response is likely to be. A request that simply says “send me everything you have on me” tends to get a slower, narrower response than one that lists out the categories above.

How to Make a DSAR to HMRC, Step by Step

1. Put it in writing. Email or letter both work. There is no special form, but writing “Subject Access Request” clearly at the top helps make sure it is routed and recognised correctly rather than treated as ordinary correspondence.
2. Confirm your identity clearly. Include your full name, date of birth, National Insurance number and/or Unique Taxpayer Reference and your current address. HMRC is entitled to ask for reasonable proof of identity before responding, so including this detail upfront avoids delay.
3. List specific categories of information rather than a vague general request – case notes, risk scores, referral notes, third-party data received about you and the source of any information not obtained from you directly.
4. Reference any relevant case or reference number you already have, such as an enquiry reference or COP9 reference, so HMRC can locate the right systems and files.
5. State that you expect a response within one calendar month, which is the statutory deadline and ask to be told promptly if HMRC believes any exemption applies and to which specific items.
6. Send it to the right team. Where you already have a named caseworker or office dealing with an open enquiry or investigation, send the request there as well as to HMRC’s central data protection team, to reduce the risk of it being processed without reference to the live case file.

What HMRC Can Lawfully Withhold

HMRC does not have to hand over everything, but the exemptions it can rely on are narrower than its standard refusal letters sometimes suggest. The main one is the “crime and taxation” exemption in the Data Protection Act 2018. In plain terms, this allows HMRC to withhold a specific piece of information only where giving it to you would be likely to genuinely damage an ongoing assessment of your tax position or an ongoing investigation into crime. It is not a blanket exemption for “anything connected to an open case”, and the courts have confirmed that HMRC has to look at each document or part of a document and explain specifically why disclosing it now would cause real harm – a generic statement that an investigation is open is not, by itself, a lawful basis for refusing the whole file.

HMRC can also withhold information that would identify a third party – for example, an informant – without that person’s consent, although this normally means redacting their name rather than withholding the whole document. And it can withhold genuine legal advice from a qualified solicitor or barrister, although this does not extend to advice from an accountant, even tax advice that looks very similar to legal advice in substance.

If HMRC tells you a particular item is exempt, it should say which exemption applies and, where possible, why. A response that simply says “some information has been withheld under the relevant exemptions” without any further explanation is not a complete or compliant response and is worth challenging.

How Long It Takes

HMRC must respond within one calendar month of receiving your request (and confirming your identity, if it needed to ask for proof). This can be extended by up to two further months if the request is complex or you have made several requests, but HMRC must tell you within the first month if it is doing this and explain why.

In our experience, straightforward requests are usually answered within the one-month window, but requests involving an active investigation, multiple HMRC teams or older records sometimes take the full extended period. If HMRC is heading towards or past the deadline without explanation, a polite follow-up referencing the statutory timescale is usually enough to prompt a response; if not, the escalation routes below are available.

What to Do If HMRC Refuses or Ignores You

If HMRC misses the deadline, gives an unexplained blanket refusal or you believe its response is incomplete, you have several options, usually worth trying in this order:

1. Write back specifically. Identify exactly what is missing or unexplained and ask HMRC to address that point directly, referencing the one-month statutory deadline if it has already passed.
2. Complain to the Information Commissioner’s Office (ICO). This is free and does not require a solicitor. The ICO can investigate and require HMRC to comply, although this can take some months.
3. Apply to the court. Under the Data Protection Act 2018, you (or a solicitor on your behalf) can ask the court to order HMRC to comply with your request. This is faster than an ICO complaint and can, in some circumstances, also lead to compensation if HMRC’s failure has caused you genuine distress or loss.
4. Raise it within your tax dispute. If the missing information is directly relevant to an ongoing enquiry or tribunal appeal – for example, because it bears on whether HMRC genuinely “discovered” something new or on how your behaviour has been characterised – it is often worth raising the disclosure gap as part of that dispute as well as or instead of, a standalone complaint.

Using the Response in Your Case

Once you receive a response, the most valuable material is usually the internal case notes and any risk-assessment or referral commentary, because this is where HMRC’s actual reasoning – as opposed to the version presented in formal letters – tends to surface. Look in particular for: dates that help establish or undermine HMRC’s timeline for a discovery assessment; language describing your behaviour, which can support or undercut a penalty dispute; and references to the source of information that triggered the case, which can help you understand (and sometimes challenge) the basis for the enquiry in the first place.

If you are working with an accountant or tax adviser on an active dispute, it is worth sharing the DSAR response with them directly, since they will usually be best placed to identify which parts of it are relevant to the specific arguments in your case.

Frequently Asked Questions

Related guides in this series

• FOI vs DSAR Against HMRC: Which Request Do You Need?
• How HMRC’s Connect System Finds Undeclared Income
• HMRC Schedule 36 Information Notices Explained