Manchester United Supporters' DSAR Toolkit & Handbook
About this handbook
This handbook is designed to help supporters make a clear and effective Data Subject Access Request, commonly called a DSAR or SAR.
Progressive versioning commitment
Version 8 is cumulative. It retains and expands the useful content developed in Versions 5, 6 and 7 rather than replacing it with a shorter rewrite.
| Version | Retained or added |
|---|---|
| Version 5 | Quick Start, Manchester United data categories, copy-and-complete request template, supporter checklist. |
| Version 6 | Why submit a DSAR, supporter scenarios, questions to answer, expanded response tracker. |
| Version 7 | Proper graphical process flow using vector artwork rather than text or ASCII symbols. |
| Version 8 | Full handbook structure, detailed legal explanation, device-data section, sanction examples, complete email template, follow-up and complaint templates, improved print design, contents, headers and footers. |
How to use it
Fast route
Use the Quick Start and full email template to submit a request promptly.
Detailed route
Read the supporter scenarios and data categories to tailor the request.
Review route
Use the response checklist, follow-up template and complaint guidance.
Contents
Quick Start
A supporter can prepare and send a clear DSAR in around ten minutes using the steps below.
Quick Start checklist
| Done | Task | Your entry |
|---|---|---|
| ☐ | Full name | |
| ☐ | Current and previous address, where relevant | |
| ☐ | Email address or addresses used with the Club | |
| ☐ | Telephone number | |
| ☐ | Membership, supporter or customer number | |
| ☐ | Season Ticket number, where applicable | |
| ☐ | Relevant match, incident, suspension or correspondence dates | |
| ☐ | Copy and complete the email template | |
| ☐ | Save a copy or screenshot before sending | |
| ☐ | Record the date submitted and expected deadline |
What is a DSAR?
A Data Subject Access Request is a request for your own personal data and information explaining how that data is processed.
The right is commonly called the right of access. The ICO explains that it allows people to obtain a copy of their personal information and supplementary information, helping them understand how and why it is being used and check whether the use is lawful.
What you can normally ask for
- Confirmation of whether personal data about you is being processed.
- A copy of your personal data.
- The purposes for which it is processed.
- The categories of personal data involved.
- Recipients or categories of recipients.
- Retention periods or the criteria used to set them.
- The source of data not collected directly from you.
- Relevant information about automated decision-making or profiling, where applicable.
What makes a request valid?
A request does not need special legal wording or a standard form. It can be made verbally or in writing. For clarity and evidence, email is usually the most practical method.
Timescales, identity and scope
Response time
The usual deadline is without undue delay and within one month. The organisation may extend the deadline by up to two further months where necessary because the request is complex or the same person has made several requests. It should explain the extension within the initial month.
Identity checks
The Club may request information needed to confirm your identity. Any request should be reasonable and proportionate. Supplying your supporter identifiers, account email, address and relevant dates can help locate records and reduce unnecessary delay.
Clarification
An organisation may ask you to clarify the information required where this is reasonably necessary. Current ICO guidance states that the response clock may pause while genuinely necessary clarification is awaited. You cannot be forced to narrow a valid request, although a clear scope can make the response more useful.
Search standard
The organisation must make a reasonable and proportionate search. A DSAR does not require a search that is unreasonable or disproportionate to the importance of the information.
Cost
Most DSARs are free. A reasonable fee may be charged in limited circumstances, including manifestly unfounded or excessive requests or requests for further copies.
What a DSAR cannot do
Not automatically an appeal
A DSAR gives access to personal data. It does not itself reverse a season ticket sanction or decide whether a sanction was fair.
Not every document
You are entitled to your personal data, not necessarily every complete document in which it appears.
No new information
The Club does not have to create records or explanations that do not already exist, although supplementary Article 15 information must still be provided.
Third-party rights matter
Information about other people may be redacted or withheld where disclosure would adversely affect their rights.
Exemptions and redactions
Some information may lawfully be withheld or redacted. Exemptions must be considered according to the particular facts. Where a request is refused, the organisation should explain the reasons, the right to complain to it, the right to complain to the ICO and the possibility of court enforcement.
Why might a supporter submit a DSAR?
A DSAR can help a supporter understand what personal data exists, whether it is accurate and how it has been used.
| Situation | A DSAR may help you understand |
|---|---|
| Season Ticket suspension or sanction | What personal data relating to you was recorded, reviewed, generated or used in connection with the action. |
| Account flagged for unusual activity | Whether account flags, indicators, logs, risk labels, profiling outputs or related notes exist as your personal data. |
| Ticket transfer or forwarding dispute | What ticket relationship, forwarding, transfer, app or account records are linked to you. |
| Membership or account dispute | What membership history, account notes, service records and internal correspondence contain your data. |
| Customer service complaint | What recordings, emails, case notes, complaint records and escalation notes are held. |
| Survey or consultation | What responses are linked or attributable to you and how those responses are stored or used. |
| Identity verification | What verification information was processed, by whom, for what purpose and for how long. |
| Possible inaccurate information | Whether records about you are wrong, incomplete or misleading and may need correction. |
Scenario: Season Ticket holder sanction
What a supporter may want to establish
- What personal data triggered or contributed to the review.
- What records, notes, labels or flags were created about the supporter.
- Which systems and departments held or processed that data.
- Whether data came from ticketing systems, account access records, digital platforms, third parties or football bodies.
- Whether any automated processing, profiling or risk indicators were involved.
- Whether a human reviewed the data and what personal data was before that reviewer.
- Whether information was shared externally and, if so, the category of recipient.
Useful categories to request
- Investigation records, case notes and account annotations containing your personal data.
- Decision records and reviewer notes containing your personal data.
- Ticketing, access, attendance, forwarding, transfer and resale records.
- Account login, app, web, session, device or network-related identifiers where held as personal data and relevant to the action.
- Fraud-prevention, misuse-detection, risk or anomaly indicators linked to you.
- Sources of information and categories of recipients.
Other supporter scenarios
Ticket forwarding dispute
Request forwarding and relationship records, ticket ownership history, account actions, relevant communications, system notes and applicable audit information.
Membership or renewal issue
Request membership status history, renewals, payments, account changes, service contacts and internal notes containing your data.
Customer service complaint
Request call recordings, transcripts where available, emails, complaint logs, escalation notes and outcome records.
CCTV or matchday incident
Identify the date, time, location and clothing. Footage may no longer exist if the retention period has expired and third parties may need masking.
Survey or fan consultation
Request responses attributable to you, identifiers linked to the response, relevant profiling and the stated purpose and recipients.
Marketing or profiling concern
Request preferences, inferred interests, segmentation, campaign history, sources and explanations of relevant profiling.
What personal data may the Club hold?
Manchester United's privacy policy describes a broad range of processing, including account management, ticketing relationships, fraud screening and prevention, crime prevention, safety and security, marketing, market research, digital personalisation, telephone recording and CCTV.
| Category | Possible examples | Why request it? |
|---|---|---|
| Identity and contact data | Name, address, email, telephone number, supporter identifiers. | To confirm how your identity is represented across systems and identify inaccuracies. |
| Ticketing | Purchases, applications, allocations, attendance, forwarding, resale, donation, transfer and app-ticket activity. | To understand the record of transactions and actions linked to your account. |
| Membership and subscriptions | Membership history, renewals, benefits and subscription records. | To resolve membership or entitlement disputes. |
| Relationships | Strong and standard e-ticketing relationships and app-ticketing relationships. | To understand who may manage, view or interact with tickets linked to you. |
| CRM and account records | Profiles, preferences, account notes and service history. | To identify internal records or labels about you. |
| Payments and purchases | Transaction history and related payment references. | To check purchasing history and data shared with service providers. |
Data categories continued
| Category | Possible examples | Why request it? |
|---|---|---|
| Customer services | Emails, call recordings, chat records, enquiries, complaints, cases and escalation notes. | To understand how concerns were recorded and handled. |
| Security and incidents | Incident reports, steward reports, security notes, investigations and sanctions containing your personal data. | To understand records connected with a matchday or account action. |
| Fraud and misuse prevention | Screening results, indicators, flags or information received from prevention agencies where these are personal data. | To understand whether your data was assessed or classified. |
| Identity verification | Verification status, results, identifiers and provider-related records. | To understand what was verified and the retention period. |
| Telephone and CCTV | Recorded calls and footage from public Club premises, subject to retention and third-party rights. | To access evidence of interactions or incidents. |
| Surveys and engagement | Survey answers, consultation submissions, feedback and related identifiers. | To see what is attributed to you and how it is used. |
| Marketing and profiling | Preferences, campaign records, inferred interests, segmentation and personalisation. | To understand targeting, personalisation and profile accuracy. |
| Third-party and football-body data | Information received from service providers, law enforcement, fraud-prevention agencies, football authorities, clubs or event organisers. | To identify sources and categories of recipients. |
Device, app, website and network data
Digital records can be personal data where they identify or are reasonably linked to an individual or supporter account.
Manchester United's privacy policy says it may collect data when people use its website or app and may use data to track, personalise and improve digital-platform experiences. Its cookie policy also describes learning from preferences during website visits.
Examples worth asking about where relevant
- Account login history and timestamps.
- IP addresses or network identifiers linked to your account.
- Device identifiers, browser or operating-system information.
- App session records, ticket-viewing events or app-ticket actions.
- Cookie, analytics or digital interaction identifiers linked to you.
- Failed login attempts, security events or anomaly indicators.
- Fraud, bot, automation, unusual-behaviour or misuse indicators linked to your account.
- Data used to associate multiple accounts, sessions or devices.
Suggested focused wording
Before you send the request
| Done | Information to gather |
|---|---|
| ☐ | Your full name and any previous name used on the account. |
| ☐ | Current and previous addresses relevant to the account. |
| ☐ | All email addresses and telephone numbers used with the Club. |
| ☐ | Membership, supporter, customer, hospitality or Season Ticket numbers. |
| ☐ | Relevant fixture, incident, complaint, suspension or appeal dates. |
| ☐ | Copies of sanction notices, correspondence or screenshots. |
| ☐ | The time period to search. |
| ☐ | The departments and systems most likely to hold the data. |
| ☐ | Your preferred electronic format and accessibility requirements. |
Where to send it
Use the current data-rights contact or process stated in Manchester United's privacy notice. Contact details can change, so check the privacy policy immediately before sending. Keep proof of submission.
Complete email template
Delete categories that clearly do not apply, but retain categories that may be relevant to the issue.
Subject: Data Subject Access Request — Article 15 UK GDPR
Dear Data Protection Officer,
I am writing to make a formal Data Subject Access Request under Article 15 of the UK GDPR and the Data Protection Act 2018.
Please provide copies of all personal data that Manchester United holds about me in a commonly used electronic format, together with the supplementary information required by the right of access.
My details
Full name: [insert]
Date of birth, if needed for identification: [insert]
Current address: [insert]
Previous address or addresses, where relevant: [insert]
Email address or addresses used with Manchester United: [insert]
Telephone number: [insert]
Membership or supporter number: [insert]
Season Ticket number: [insert]
Other relevant customer, hospitality or account number: [insert]
Relevant time period: [insert dates, or state “all personal data currently held”]
Relevant incident, fixture, sanction, complaint or correspondence dates: [insert]
Scope of request
Please search all relevant systems, repositories, departments and service providers that process personal data relating to me, including where applicable ticketing, membership, CRM, supporter services, customer services, digital platforms, marketing, fan engagement, surveys, security, investigations, fraud prevention, identity verification, telephone systems and CCTV.
Please include personal data relating to the following, where held:
- Ticket purchase, application, allocation, attendance, transfer, forwarding, resale and donation history.
- Season Ticket, membership, subscription, waiting-list and renewal history.
- Strong, standard or app-ticketing relationships associated with my account.
- CRM records, supporter profile information, preferences, account notes and case-management records.
- Emails, internal correspondence, messages, telephone recordings, transcripts, live-chat records, complaints and customer-service notes containing my personal data.
- Survey responses, consultation submissions, supporter feedback and fan-engagement records attributable to me.
- Security, steward, incident, matchday, investigation, sanction, appeal, review and decision records containing my personal data.
- Reviewer notes, case notes, account annotations, flags, classifications, indicators and risk labels linked to me or my account.
- Identity-verification records and verification outcomes, including the provider used and applicable retention information.
- CCTV footage containing my image, where relevant and still retained.
- Marketing preferences, campaign history, segmentation, inferred interests and personalisation records.
- Information received from third parties, fraud-prevention agencies, law-enforcement bodies, football authorities, other clubs or service providers where it relates to me.
Device, app and digital-platform data
Where held and relevant, please include personal data relating to account logins, timestamps, IP or network identifiers, device or browser identifiers, website or app sessions, digital-ticket interactions, cookies or analytics identifiers linked to me, failed access attempts, security events, unusual-activity indicators, fraud or bot-detection outputs, account-linking indicators and any other digital or device-derived data associated with me or my supporter account.
Profiling and automated processing
Please confirm whether personal data relating to me has been subject to profiling or automated processing and provide the personal data produced or used by that processing. Where applicable, please provide meaningful information about the logic involved and the significance and envisaged consequences for me.
Supplementary Article 15 information
Please also provide:
- The purposes for which my personal data is processed.
- The categories of personal data concerned.
- The recipients or categories of recipients to whom my personal data has been or will be disclosed.
- The retention period for each relevant category or the criteria used to determine it.
- The source of any personal data not obtained directly from me.
- Relevant information concerning profiling or automated decision-making.
- Information about safeguards used for relevant international transfers, where applicable.
Redactions, exclusions and searches
If any personal data is withheld or redacted, please identify the exemption or restriction relied upon and explain why it applies. Please provide the remaining personal data wherever partial disclosure is possible.
If you consider that a category requested is not held, please confirm that position. If clarification is genuinely required to locate the information, please contact me promptly and explain what clarification is needed.
Format and communication
I would prefer the response in a commonly used electronic format. Please let me know promptly if you require proportionate information to verify my identity.
Please acknowledge receipt and confirm the date by which you expect to respond.
Kind regards,
Name: [insert]
Date: [insert]
What happens after submission?
- Acknowledgement: save the acknowledgement and reference number.
- Identity check: respond promptly to a proportionate request for identification.
- Clarification: answer a reasonably necessary question without unnecessarily narrowing the request.
- Search and review: the Club should conduct a reasonable and proportionate search.
- Response: information should normally be supplied within one month, subject to valid pauses or extensions.
- Review: compare the response against your original categories and issue.
| Event | Date | Notes or reference |
|---|---|---|
| DSAR submitted | ||
| Acknowledged | ||
| ID requested | ||
| ID supplied | ||
| Clarification requested | ||
| Clarification supplied | ||
| Original response deadline | ||
| Extension notified | ||
| Response received |
How to review the disclosure
| Check | Question |
|---|---|
| ☐ | Did the response cover the relevant time period? |
| ☐ | Did it include ticketing, membership, CRM, customer service and digital-platform data where requested? |
| ☐ | Were investigation, sanction, appeal, case-note or reviewer records addressed? |
| ☐ | Were device, app, web, session, IP, network or unusual-activity data addressed where requested? |
| ☐ | Were profiling and automated-processing questions answered? |
| ☐ | Were sources, purposes, recipients and retention periods explained? |
| ☐ | Are redactions or exclusions explained? |
| ☐ | Are any records inaccurate, incomplete or misleading? |
| ☐ | Is the information understandable and in an accessible format? |
Signs that a follow-up may be appropriate
- The response only contains information already visible in your online account.
- It does not address a named investigation, sanction, call, complaint or incident.
- Requested digital or profiling categories are ignored rather than confirmed as held or not held.
- Large redactions appear without an explanation.
- Emails refer to attachments or decisions that are absent.
- Different records contain conflicting personal information.
Template: information appears missing
Subject: Follow-up to Data Subject Access Request — [reference]
Dear Data Protection Officer,
Thank you for your response dated [date] to my Data Subject Access Request submitted on [date].
Having reviewed the material, I am concerned that the response may be incomplete or that parts of my request have not been addressed.
In particular:
- [identify the missing category, date, system, communication or issue]
- [identify any unanswered request about source, purpose, recipients, retention, profiling or automated processing]
- [identify any unexplained redaction, exclusion or inconsistency]
Please confirm whether reasonable and proportionate searches were carried out across the relevant systems and departments, including [list relevant systems or departments].
If the information is not held, please confirm that. If it has been withheld, please identify the exemption or restriction relied upon and explain why it applies. Please reconsider whether partial disclosure can be made.
I would be grateful for a substantive response within a reasonable period and confirmation of the Club's data-protection complaint procedure.
Kind regards,
[name]
If the problem is not resolved
- Write to the Club identifying the specific concern.
- Ask for the matter to be reviewed through its data-protection complaint procedure.
- Keep the original request, acknowledgement, response, attachments and follow-up.
- If still dissatisfied, consider complaining to the Information Commissioner's Office.
Useful evidence for a complaint
- Your original DSAR and proof of submission.
- The Club's acknowledgement and any ID or clarification correspondence.
- The response and supplied files.
- Your focused explanation of what is missing or inadequate.
- Your follow-up and the Club's final position.
- A clear chronology.
Template: data-protection complaint
Subject: Complaint about handling of my Data Subject Access Request
Dear Data Protection Officer,
I am making a formal complaint about the handling of my Data Subject Access Request submitted on [date], reference [reference].
My concern is that:
- [the response was late / categories were not addressed / searches appear incomplete / redactions were not explained / supplementary information was missing / other]
I raised these concerns on [date], but [summarise the reply or absence of reply].
I ask the Club to review the handling of my request, carry out any further reasonable and proportionate searches required, provide any outstanding personal data and supplementary information, and explain any exemption or restriction relied upon.
Please provide the outcome of the complaint and details of any further review route.
Kind regards,
[name]
What are you trying to understand?
| Select | Question |
|---|---|
| ☐ | What information does the Club hold about me? |
| ☐ | What personal data was used in connection with an account or ticketing action? |
| ☐ | Were flags, risk indicators, profiling or automated processing linked to me? |
| ☐ | What digital, app, device, session or network data is linked to me? |
| ☐ | Who reviewed or received my personal data? |
| ☐ | Where did information about me come from? |
| ☐ | Has my personal data been shared externally? |
| ☐ | Are records inaccurate, incomplete or misleading? |
| ☐ | How long will each category be retained? |
My key dates and facts
| Item | Details |
|---|---|
| Relevant fixture or event | |
| Date action was taken | |
| Date notified | |
| Departments contacted | |
| Reference numbers | |
| Key systems or categories |
Glossary
| Term | Meaning |
|---|---|
| Personal data | Information relating to an identified or identifiable living person. |
| Processing | Almost any operation performed on personal data, including collecting, storing, using, sharing or deleting it. |
| Controller | The organisation that decides why and how personal data is processed. |
| Processor | An organisation processing personal data on behalf of a controller. |
| DSAR / SAR | A Data Subject Access Request or Subject Access Request. |
| Profiling | Automated processing used to evaluate or predict aspects of a person, such as behaviour, preferences or risk. |
| Automated decision | A decision made by automated means without meaningful human involvement. |
| Recipient | A person or organisation to whom personal data is disclosed. |
| Retention period | The time personal data is kept before deletion or anonymisation. |
| Redaction | Removal or obscuring of information before disclosure. |
| Exemption | A legal provision allowing or requiring some information or obligations to be restricted in particular circumstances. |
Sources and further guidance
- Manchester United Privacy Policy, last updated 18 June 2026: https://www.manutd.com/en/help/privacy-policy
- Manchester United App Ticketing information: https://www.manutd.com/en/apptickets
- Manchester United Cookie Policy: https://www.manutd.com/en/help/cookie-policy
- ICO — A guide to subject access, updated 16 July 2026: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/
- ICO — Getting copies of your information: https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/
- UK GDPR Article 15: https://www.legislation.gov.uk/eur/2016/679/article/15
- Data Protection Act 2018: https://www.legislation.gov.uk/ukpga/2018/12/contents
Accuracy note
The data categories in this handbook combine categories expressly described in Manchester United's published privacy information with examples of records that may constitute personal data in ticketing, digital, security and customer-service contexts. Not every category will necessarily be held about every supporter.
Legal and publication disclaimer
This handbook provides general information and practical drafting assistance. It does not provide legal advice, determine whether any sanction or investigation was lawful, or state that particular data was used in an individual case. Supporters should check current Club and ICO guidance before sending a request.