How do I make a subject access request after a baby sample pack?

What can a SAR show after a sample pack?

A subject access request (SAR, sometimes DSAR) is the ICO’s right of access. You can ask whether an organisation is using or storing your personal information and ask for copies. After a baby pack, the useful extras are which fields they hold and who they sent them to.

In [Underwood & Anor v Bounty UK Ltd & Anor [2022] EWHC 888 (QB)](https://www.bailii.org/ew/cases/EWHC/QB/2022/888.html) the High Court recorded Bounty’s 23 May 2019 SAR reply. It confirmed it held the mother’s name, date of birth, home address and email, and the child’s name, gender and date of birth. It also confirmed it had shared some or all of that with nine third-party organisations. The judgment names Indicia as receiving all of those fields plus an IP address, and the Master Photographers Association as receiving name, postal and email addresses, due date, and the baby’s date of birth and gender.

Cite Underwood for what a SAR can list — fields plus recipients — not as a description of any club’s current sharing. Bounty’s 2017–18 broking was the subject of a separate ICO penalty.

How do I send a SAR to the club and the brands?

Anyone can send a SAR. The ICO says you do not need a solicitor. Its public Make a subject access request service drafts an email to the address you supply and keeps a copy for you; the organisation replies to you, not to the ICO.

1. 1
   Find the privacy email Take it from the notice on the claim you submitted. Nestlé SMA publishes [email protected]. Danone publishes a data-subject-rights webform that includes Baby Club Member. If you only have a support inbox, you can still send the SAR there — the ICO says any part of the organisation can receive it.
2. 2
   Use a clear subject line The ICO suggests a header that says “subject access request”, the date, your name and the email or account used for the pack.
3. 3
   Ask for the useful extras Ask for: all personal data held about you and the baby; the source; the recipients or categories of recipient; and the dates of any sharing. You can ask for everything, but a focused ask is faster. The ICO says organisations can sometimes refuse parts of a request or take longer if you ask for “everything” with no dates.
4. 4
   Add ID only if they need it The ICO tool suggests a passport or driving licence plus a proof of address. The public SAR guidance says they should only ask for what is reasonable; the one-month clock starts when they have that ID.
5. 5
   Write to partners the reply names Each recipient is a separate controller. Privacy International’s Bounty explainer makes the same point: a SAR to the club is step one; each organisation that still holds a copy needs its own request if you want erasure there too.

Can I include my baby's data in the SAR?

Yes, if you can show parental responsibility. The ICO’s SAR service says that when you apply for someone else you should send proof of ID and address for them, plus evidence you are allowed to ask — for a child, a birth or adoption certificate is the example it gives.

The ICO’s children’s guidance is the legal frame: the rights are the child’s. A person with parental responsibility can usually exercise them where the child is not competent and it is in the child’s best interests. For a newborn after a sample pack, that is the usual route.

Ask specifically for the baby’s name, gender, expected or actual date of birth, and any “first baby” flag. Those are the fields the Underwood SAR reply listed, and the fields Pampers and SMA say they collect for personalisation today.

How long should they take, and what if the reply lists third parties?

The ICO’s access guidance says organisations usually have one month. They may extend for a complex request if they tell you. They should not charge a fee in ordinary cases.

In shortSend a SAR to the club that took the claim and to any brand the reply names. Ask for mum and baby fields plus recipients. The Underwood judgment shows that list can come back in black and white. ICO time is one month.