A subject access request (SAR) gives every employee in the UK a legal right to see the personal data their employer holds about them. Enshrined in the UK GDPR and…
A subject access request (SAR) gives every employee in the UK a legal right to see the personal data their employer holds about them. Enshrined in the UK GDPR and the Data Protection Act 2018, it's one of the most powerful tools workers have to understand how their information is being used, stored, and shared. For employees, a SAR can shine a light on hiring decisions, disciplinary records, performance notes, emails mentioning them by name, and much more. For employers, it's a legal obligation that carries strict deadlines and real consequences if mishandled.
Why does it matter? Because trust in the workplace depends on transparency. A SAR often surfaces during moments of tension, such as a grievance, a redundancy, or a suspected unfair dismissal. How it's handled can shape the outcome of a dispute. Whether you're an employee weighing your options or an HR professional managing a request, understanding the process is essential.
What Is subject access request employee UK?
A subject access request employee UK refers to the formal right of any worker in the United Kingdom to ask their employer for a copy of the personal data held about them. This right is enshrined in Article 15 of the UK GDPR and reinforced by the Data Protection Act 2018. It applies to current staff, former employees, job applicants, contractors, and even agency workers, provided the organisation processes their personal information.
The scope is deliberately broad. Employees can request access to emails mentioning them, HR files, disciplinary records, performance reviews, CCTV footage, payroll data, occupational health reports, and internal communications discussing their conduct or role. If the information identifies them, directly or indirectly, it likely falls within scope. There is no need for the employee to justify why they want the data, and requests can be made verbally or in writing.
Employers must respond within one calendar month. This can be extended by a further two months for complex or voluminous requests. Crucially, the request must be handled free of charge in most circumstances. Certain exemptions apply, such as information relating to management planning, legal privilege, or third-party data that cannot reasonably be disclosed.
For employees, a SAR often becomes a tool during grievances, disciplinary proceedings, or tribunal claims. For employers, it represents a significant compliance obligation, and mishandling one can attract scrutiny from the Information Commissioner's Office. Understanding both perspectives is essential to handling the process fairly and lawfully.
Key Benefits of subject access request employee UK
A subject access request employee UK process offers workers a powerful legal tool under the UK GDPR and Data Protection Act 2018. When used effectively, it delivers tangible advantages that go well beyond simple curiosity about what an employer holds on file.
Transparency and accountability. The primary value lies in visibility. Employees gain a clear view of the personal data their employer processes, from HR files and performance reviews to internal emails mentioning them by name. This transparency holds organisations accountable for how they handle workforce information and often surfaces inaccuracies that can then be corrected.
Evidence gathering in disputes. For employees facing grievances, disciplinary action, discrimination claims, or unfair dismissal proceedings, a SAR can uncover critical evidence. Internal communications, manager notes, and decision-making records frequently reveal context that supports (or undermines) an employer's stated reasoning. Solicitors often recommend submitting a SAR before lodging a tribunal claim precisely because of this.
Cost-free access. Unlike disclosure processes in litigation, a SAR carries no fee in most circumstances. Employers must respond within one calendar month, extendable by two months only for complex requests. This makes it an accessible route for employees who may not yet have engaged legal representation.
Correcting the record. Once errors emerge, the right to rectification allows employees to challenge inaccurate data. This matters enormously for references, promotion decisions, and long-term career prospects, where a single misleading note can cause lasting damage.
Rebalancing the employment relationship. Employment inherently involves a power imbalance. A SAR gives employees a formal, enforceable mechanism to scrutinise their employer's conduct, reinforcing the principle that personal data belongs to the individual, not the organisation processing it.
Used thoughtfully, a SAR is both a protective shield and an investigative tool. It gives employees genuine agency over information that directly shapes their working lives.
How subject access request employee UK Works
When an employee in the UK submits a subject access request (SAR), they're exercising a statutory right under Article 15 of the UK GDPR and the Data Protection Act 2018. Here's how the process actually unfolds from start to finish.
Step 1: The request is made. An employee can submit a SAR verbally or in writing, to any part of the organisation. They don't need to use the phrase "subject access request" or cite legislation. A casual email to a line manager asking "can I have a copy of my personnel file?" counts.
Step 2: Identity verification. The employer may ask for reasonable proof of identity, but only if there's genuine doubt. For a current employee, this is rarely necessary. The one-month response clock pauses until identity is confirmed.
Step 3: Clarification (if needed). If the request is broad, the employer can ask the employee to narrow the scope, for example, specifying date ranges or particular systems. Again, the clock pauses.
Step 4: Searching and gathering data. The employer must locate all personal data relating to the employee. This includes HR files, emails mentioning them, CCTV footage, performance records, Slack messages, and notes on shared drives. It's often more extensive than employers expect.
Step 5: Reviewing and redacting. Third-party personal data must be redacted or removed unless those individuals consent or it's reasonable to disclose. Legally privileged material and confidential references given by the employer are exempt.
Step 6: Responding within one month. The employer must provide the data, usually electronically, along with information about processing purposes, retention periods, and the employee's further rights. Complex requests can be extended by two additional months, with the employee informed of the extension and reasons within the first month.
Failure to comply properly can lead to ICO complaints and enforcement action.
Common Questions About subject access request employee UK
How long does my employer have to respond to my SAR?
One calendar month from the day they receive your request. If your request is complex or you've made multiple requests, they can extend this by a further two months, but they must tell you within the first month and explain why.
Do I have to pay for a subject access request?
No. SARs are free under UK GDPR. Your employer can only charge a "reasonable fee" if your request is manifestly unfounded or excessive, or if you're asking for further copies of information already provided.
Can my employer refuse my SAR?
Only in limited circumstances. They can refuse if the request is manifestly unfounded or excessive, but they must justify this decision. They can also withhold certain information, such as data that identifies other people, legally privileged material, or management forecasting data.
What information can I ask for?
You're entitled to a copy of your personal data, including emails mentioning you, HR records, disciplinary notes, performance reviews, CCTV footage, and manager comments. You're not entitled to documents that don't contain your personal data.
Do I need to give a reason for my request?
No. You don't have to explain why you want your data, even if you're in the middle of a grievance or tribunal claim.
What if my employer ignores my request?
You can complain to the Information Commissioner's Office (ICO) or bring a claim in court. Keep written evidence of your request and any responses.
Conclusion
Handling a subject access request from an employee in the UK isn't just a legal obligation under UK GDPR. It's a chance to demonstrate that your organisation takes privacy seriously. Get it wrong, and you risk ICO complaints, tribunal claims, and reputational damage. Get it right, and you build trust.
The essentials are straightforward. Acknowledge the request promptly. Verify identity where necessary. Search thoroughly across emails, HR files, and messaging platforms. Apply exemptions carefully, redact third-party data, and respond within one month unless a valid extension applies.
Remember, employees often submit SARs during difficult moments, whether grievances, disciplinaries, or exits. Treating the process with fairness and transparency matters as much as meeting the deadline.
Your next step? Review your current SAR procedure today. Map out who owns each stage, document your search methodology, and train your managers to spot a request when it arrives. Preparation now saves considerable stress later.
Learn more about Disciplinary and Dismissal Procedures.
