Subject Access Requests From Employees: What UK Employers Need to Know
Employees and ex-employees can ask for a copy of the personal data you hold about them. What UK employers must provide, by when and what you can withhold.
Written by Himanshi Gulati
Yes, employees and former employees can make a subject access request (SAR) to their employer. You must usually respond within one month and give them a copy of their personal data, including relevant emails, HR records and notes. You can’t refuse because of a grievance or tribunal claim, but some information, such as confidential references, may be exempt.
Employment SARs are some of the hardest requests an organisation handles. They often arrive during a dispute, they can cover years of emails and they nearly always involve other members of staff. This guide explains what UK employers need to provide, by when and what you can lawfully hold back.
Can an employee make a subject access request?
Yes. The right of access applies to anyone whose personal data you hold, and that includes current staff, former staff, job applicants and contractors. A request doesn’t need to use the words “subject access request”. It only needs to be clear that the person is asking for their own personal information.
A request can be made verbally or in writing, including by email, text or social media. It can go to anyone in the organisation, not only HR. The ICO recommends having a designated person, team and email address for SARs, so that line managers know where to send them straight away.
How long do you have to respond?
You must respond without undue delay and at the latest within one month of receiving the request. You can extend this by up to two further months if the request is complex or the person has made several requests. If you extend, you must tell them within the first month and explain why.
If you genuinely need to clarify what the person is asking for, the clock pauses until they reply. Only ask if you hold a large amount of information about them and clarification is reasonably needed. They don’t have to narrow the request. If they won’t, carry out reasonable searches based on what they asked for.
Do you need to verify the employee’s identity?
You need to be satisfied that you know the identity of the person making the request and that the information relates to them. If you have reasonable doubts about their identity, you can ask for information needed to confirm who they are and the one-month deadline begins when the identity or authority in case of (solicitors) has been confirmed. However, employers should not routinely request additional identification where the person’s identity is already clear. Any information requested for identity verification should be reasonable and proportionate.
What does an employee SAR usually cover?
Most employee requests ask for everything. That can include:
- the personnel file, contracts and pay records
- appraisals, absence and sickness records
- disciplinary and grievance records, including meeting notes
- emails, chat messages and documents that mention the person
- CCTV footage, door entry logs and system access records.
You only have to provide the person’s own personal data, not every document they appear in. An email they were copied into isn’t automatically all their personal data. Their name and email address must be disclosed, but the rest depends on whether the content is about them.
How far do you have to search?
UK GDPR now says a person is entitled to what you can provide based on a reasonable and proportionate search. This was added by the Data (Use and Access) Act 2025, with effect back to 1 January 2024. It doesn’t let you skip obvious places. It does mean you can stop short of searches that are disproportionate to the value of the information.
In practice, agree a search plan before you start. Record which systems you searched, which search terms you used and why you decided a search was or wasn’t proportionate. Include business social media accounts if the person’s data is likely to be there. If you’re ever challenged, that record is your evidence.
What about information about other employees?
Employee SARs almost always include information about colleagues, managers and witnesses. You don’t have to disclose information that identifies someone else unless they consent or it’s reasonable to disclose without their consent.
To decide what’s reasonable, think about:
- what kind of information it is and how sensitive it is
- whether it was given in confidence
- whether you have asked the other person for consent, and whether they refused
- the other person’s role and seniority.
Redaction (blacking out the parts that identify someone else) is often the answer. But if the requester could still work out who wrote a witness statement from the context, redacting the name alone won’t be enough. Whistleblowing reports need particular care, because the whistleblower has legal protection too. Our article on SARs involving another person covers this in more detail.
Can you refuse an employee SAR during a dispute?
No, not on that basis alone. The ICO is clear that you can’t refuse a SAR because there is an ongoing grievance, disciplinary or employment tribunal claim. Disclosing documents to the person’s solicitor during proceedings doesn’t replace your SAR response either, because it may not include all their personal data.
A settlement agreement or non-disclosure agreement doesn’t remove the right of access. The ICO says clauses that try to limit it are likely to be unenforceable.
You can refuse a request that is manifestly unfounded or manifestly excessive. The bar is high. A large volume of information isn’t enough on its own, and nor is an aggressive tone. Our guide to when you can refuse a subject access request explains the tests.
Which exemptions are relevant to employers?
Exemptions must be applied case by case, and you must record your reasons. The ones employers use most are:
Confidential references. References given in confidence for employment, training, education or similar purposes can be exempt. Make it clear in your privacy notice or staff handbook whether references are treated as confidential.
Legal professional privilege. Advice from your lawyers about the person’s case.
Management information. Information used for management planning, such as a proposed restructure, where disclosure would prejudice the business.
Negotiations. Records of your intentions in negotiations with the person, such as a settlement. This is only likely to apply while the negotiations are still going on.
These exemptions are not automatic. Whether an exemption applies will depend on the particular information and circumstances, and employers should document their reasoning where information is withheld.
What should your response include?
Your response must include a copy of the personal data and a set of supplementary information, such as the purposes of the processing, who you have shared the data with and how long you keep it. Our guide to how to respond to a subject access request sets out each item your response letter must include.
Never delete or change information after a request arrives to avoid disclosing it. The person is entitled to the data you held when you received the request, allowing for routine changes you would have made anyway.
Frequently asked questions
Can an ex-employee make a subject access request?
Yes. Former employees have the same right of access as current staff, and the same deadlines apply.
Do we need to verify identity of the requestor?
You need to be satisfied that you know the identity of the person making the request. If you have reasonable doubts about their identity, you can ask for information to confirm who they are.
Can I make a subject access request to my employer?
Yes. Ask in writing, ideally by email, and keep a copy. Say clearly that you want a copy of your personal data. Your employer must usually respond within one month.
Do we have to send every email that mentions the employee?
No. You must provide the person’s personal data found by a reasonable and proportionate search. Emails that only mention them in passing may contain little of their personal data, and other people’s information may need redacting.
Can we charge a fee?
Usually not. You can charge a reasonable fee for further copies, or for a request that is manifestly unfounded or excessive.
Can we ask an employee to narrow their SAR?
You can ask for clarification where you hold a large amount of information about the person and it is not clear what information they are requesting.
Get help with employee SARs
Employee SARs take time and judgement, especially when they arrive mid-dispute. Our SAR Support team can search, review and redact records for you, or advise your team on a difficult request. For the basics, start with what is a subject access request. Tell us about your request and a qualified consultant will respond within two working hours.