Employee Subject Access Requests: What UK Employers Must Do

When a current or former employee makes a subject access request (SAR), they are exercising the same right of access as any other individual. There is no separate or reduced standard for workplace requests.

An employee can ask an employer to confirm whether it processes their personal data, provide a copy of that data and supply the accompanying information required by the UK GDPR. The employer must respond without undue delay and generally within one calendar month. The period may be extended by up to two further months where the request is complex or the individual has made a number of requests.

An employee subject access request may arrive during a grievance, disciplinary process, redundancy exercise, settlement discussion or employment tribunal claim. The existence of a workplace dispute does not, by itself, remove the employee’s right of access or allow the employer to postpone its response. The SAR must be handled separately from any disclosure obligations arising in legal proceedings.

This combination of data protection duties and complex workplace records can make employee SARs particularly challenging. Employers need to identify the employee’s personal data, conduct reasonable and proportionate searches, apply any exemptions carefully and protect information relating to other people.

What Does an Employee Subject Access Request Cover?

An employee SAR is not automatically limited to the individual’s personnel file. It applies to their personal data wherever that information is held by or on behalf of the employer.

Depending on the request and the employer’s systems, relevant personal data may appear in:

  • personnel and HR records;
  • payroll, pension, benefits and attendance records;
  • appraisal and performance-management documents;
  • disciplinary, grievance and investigation records;
  • emails, documents and workplace messages;
  • occupational health and sickness absence records;
  • access logs, call recordings and CCTV footage; and
  • information held by processors acting on the employer’s behalf.

The employer is not required to disclose every document in which the employee’s name appears. The right relates to the employee’s personal data, not necessarily to complete documents. For example, an email copied to an employee may contain information about a business matter without containing substantive personal data about that employee.

Employers should assess the content and context of each record rather than treating every name reference as automatically disclosable.

How Can an Employee Make a SAR?

There is no prescribed form or wording for a valid SAR. A worker may make one verbally or in writing, including by email or social media, and may submit it to any part of the organisation. They do not need to use the expression “subject access request”, refer to Article 15 or explain why they want the information.

Requests such as “Please send me my HR file”, “Can I have the notes from my appraisal?” or “Please provide the emails between my manager and HR about my warning” may all constitute SARs.

A request may also be contained within a grievance, appeal or other correspondence. Managers and front-line employees should therefore know how to recognise a potential SAR and where to send it promptly.

Personal Devices and Informal Workplace Channels

Work-related personal data does not fall outside the scope of a SAR simply because it is held outside the main HR system.

If managers use personal devices or informal communication channels for business purposes, relevant personal data may need to be considered as part of the employer’s search. This can include business-related WhatsApp messages, text messages, Teams chats or other workplace communications that are held by or accessible to the organisation.

Employers should take a risk-based approach and identify the systems, accounts and individuals reasonably likely to hold relevant information. They are expected to conduct a reasonable and proportionate search, rather than automatically searching every device or communication ever used within the business.

Clear rules on using personal devices and authorised communication platforms can make future employee SARs easier to manage.

Does an Ongoing Workplace Dispute Change the Rules?

An employee does not lose their right of access because they are involved in a grievance, disciplinary process, settlement discussion or tribunal claim.

The ICO’s employer guidance specifically addresses SARs made during tribunal or grievance processes. Employers should not assume that the existence of a parallel dispute allows them to refuse or delay the request.

The employee’s motive will not ordinarily determine whether the employer must comply. However, the employer may consider whether a request is manifestly unfounded or excessive in the particular circumstances. This is a high threshold and must be assessed carefully. The fact that a request is inconvenient, time-consuming, connected with a dispute or likely to assist the employee in proceedings does not, on its own, establish that threshold.

Where litigation is underway, the SAR and the legal disclosure process remain separate. Information that is not disclosable under a SAR may still need to be disclosed during proceedings, and the reverse may also apply.

What Information Can an Employer Withhold or Redact?

A SAR does not give an employee an unrestricted right to receive every record held by their employer. Exemptions and restrictions may apply, but they must be considered individually and not used as blanket reasons for withholding information.

The ICO states that exemptions should be applied case by case. Employers should document why an exemption applies and be able to justify their decision.

 

Legal professional privilege

Personal data may be withheld where it is contained in material protected by legal professional privilege.

Legal advice privilege generally covers confidential communications between a client and a professional legal adviser made for the purpose of seeking or obtaining legal advice. Litigation privilege may cover qualifying confidential communications created for the dominant purpose of contemplated, pending or existing litigation.

The exemption does not automatically protect every internal email that mentions legal risk, a grievance or possible proceedings. Ordinary communications between HR and management are not privileged merely because they concern a legal issue. The employer should establish that the relevant legal test is met for each communication.

Confidential references

The Data Protection Act 2018 contains a specific exemption for certain confidential references given or received for specified purposes, including employment.

Employers should not assume that every document described as a “reference” is exempt. The information must fall within the statutory conditions, including the requirement that the reference was given in confidence for a qualifying purpose.

An internal appraisal, manager’s note or routine workplace opinion does not automatically become a confidential reference simply because it contains comments about an employee. The nature, purpose and confidentiality of the communication must be examined before relying on the exemption.

Information about other people

Workplace records frequently contain personal data relating to the requester and other identifiable people. Examples include witness statements, grievance interviews, complaints, investigation notes and emails involving several employees.

Where responding to the SAR would disclose information about another person, the employer must consider whether that information can be redacted or whether it is reasonable to disclose it without consent. Factors may include the type of information, any duty of confidentiality, the other person’s expectations and the potential impact of disclosure.

Consent may be sought where appropriate, but it is not the only consideration. Names should not be removed automatically where the surrounding information would still identify the individual, and entire records should not be withheld where effective redaction would allow the requester’s personal data to be disclosed.

 

Management information

An exemption may apply to information processed for management forecasting or management planning where disclosure would be likely to prejudice the conduct of the employer’s business or activity.

This may be relevant to matters such as proposed restructuring, staffing plans or redundancy forecasting. However, it is not a general exemption for documents created by managers or information that the employer would prefer to keep confidential.

The employer must be able to identify the relevant management planning or forecasting purpose and demonstrate the likelihood of prejudice. The exemption should only be applied to the extent necessary.

Negotiations with the requester

Information recording the employer’s intentions in negotiations with the employee may be exempt where disclosure would be likely to prejudice those negotiations.

This may arise during genuine settlement or other negotiations, but it does not permit the employer to withhold every document connected with the discussions. The exemption is focused on information that records the employer’s intentions and is subject to the statutory prejudice test.

Employers should consider whether negotiations remain ongoing, what information would reveal and how disclosure would be likely to cause prejudice before relying on this exemption.

Verifying the Employee or Their Representative

Employers may request further information where they have reasonable doubts about the requester’s identity. Any verification request should be necessary and proportionate.

For current employees, identity can often be confirmed using existing workplace credentials or information already held. Employers should avoid routinely demanding passports or driving licences where less intrusive verification would be sufficient.

Extra care may be required where a request comes from a former employee using unfamiliar contact details, or from a solicitor, trade union representative or another person acting for the employee. In those circumstances, the employer may reasonably request evidence of identity and written authority to act before releasing personal data.

Verification should be requested promptly and must not be used as a tactic to delay the response.

When Can the Employer Ask for Clarification?

An employer may ask the employee for clarification where further information is reasonably required to identify the personal data or processing activities covered by the SAR.

Following the Data (Use and Access) Act 2025, the response period may be paused while the employer waits for reasonably required clarification. However, employers should not seek clarification automatically or use it simply because the request is broad or inconvenient.

The employer should explain what information would help, provide reasonable assistance and record why clarification was necessary. Where the employer can identify and retrieve the requested information quickly and easily, a clarification request may not be justified.

Clarification and complexity are separate issues. The need to clarify a request does not automatically entitle the employer to extend the overall deadline.

Building a Defensible Employee SAR Process

The quality of the process is often as important as the final disclosure. This is especially true where an employee SAR is connected with a workplace complaint or legal proceedings.

A defensible process should begin by recording the date and method of receipt. The employer should then assess identity, authority, scope and deadline before identifying the systems and individuals reasonably likely to hold relevant information.

Search instructions should be clear and appropriately targeted. They may need to cover the HR system, payroll records, relevant mailboxes, approved messaging platforms and information held by processors. The search approach should be documented, including any decision not to search a potentially relevant source.

The collected information should then be reviewed to separate the requester’s personal data from irrelevant business content, duplicates and information about other people. Any exemption or redaction should be applied consistently, recorded and quality-assured before disclosure.

For complex workplace matters, the audit trail should explain:

  • when and how the request was received;
  • how the response deadline was calculated;
  • any identity, authority or clarification enquiries;
  • the systems, locations and custodians searched;
  • the search terms and relevant date ranges used;
  • why potentially relevant sources were not searched;
  • the basis for exemptions and redactions; and
  • when and how the response was provided.

Employers handling regular workplace requests may benefit from a dedicated employee SAR procedure alongside their general [internal link: SAR response checklist for data controllers].

Where a request concerns grievances, witness evidence or complaints involving several employees, the employer should plan for substantial third-party review and redaction. Guidance on [internal link: third-party subject access requests] may assist with that assessment.

Early triage is also essential against the applicable [internal link: subject access request time limit]. Internal disagreements about responsibility, search scope or disclosure do not suspend the deadline. The response period can only be paused or extended where the legal conditions are met.

Reducing the Risk of a Second Workplace Dispute

An employee SAR should be treated as a distinct statutory process, even where it arises from a difficult employment relationship.

Employers should avoid approaching the request defensively or allowing views about the employee’s motives to influence the search. A prompt, documented and legally reasoned response is more likely to withstand scrutiny from the employee, the ICO or a court or tribunal.

The aim is not to disclose every workplace document without review. It is to identify the requester’s personal data through reasonable and proportionate searches, disclose what the law requires, protect the rights of others and apply any exemption only where its specific conditions are met.

Handled properly, an employee subject access request does not need to become another dispute layered on top of the first.