Subject access requests for employees in the UK
Your HR file, your manager's emails, the notes from that meeting: under the UK GDPR, employees and former employees can ask their employer for a copy of the data it holds about them. It's called a subject access request. It's usually free, and they normally have one month to reply.
Every employer has to answer, whatever its size. There's no minimum number of staff.
[Your name][Date]
Subject access request
Dear Data Protection Officer,
Under Article 15 of the UK GDPR, please send me a copy of all personal data you hold about me, including my HR file, emails and messages about me, and notes of meetings about me.
I worked for you as [job title] from [date] to [date].
Please reply within one month.
Be specific and you get a faster, fuller answer.
"What has my manager written about me?"
"Can I see the notes from my disciplinary?"
"What did you record about my grievance?"
"How was I scored for redundancy?"
"Why didn't I get the job?"
"What does the monitoring software record about me?"
Examples only, not real requests.
The law also gives you the story around your data, so you can see how it's being used.
Your HR file, emails and chats about you, meeting notes, appraisals and recordings, wherever they keep them.
What they use it for, and who they've shared it with, such as payroll, pension or occupational health providers.
How long they'll keep it, where they got it if not from you, and whether decisions about you are automated.
Four steps. About five minutes.
1
The staff privacy notice usually names a data protection contact. If there isn't one, send it to HR.
2
Name the records you want, the people involved and the dates. It helps them search the right inboxes.
3
Note the date they received it. They may check your identity before the clock starts.
4
Complex requests can take up to two more months, but they must tell you why within the first month.
The clock is one calendar month, not 40 days. The 40-day rule ended in 2018.
That's often allowed. What matters is that each part was held back for a reason the law accepts, and that they told you.
Witnesses and co-workers can be blacked out, unless it's reasonable to share them. Your manager's name usually stays.
Your employer's communications with its lawyers, covered by legal privilege.
References about you given in confidence, whether your employer wrote them or received them.
Plans such as redundancy proposals, while sharing them would harm the business.
Their position in talks with you, such as a settlement, while sharing it would harm those talks.
An email that mentions you in passing isn't all your data. Unrelated parts can go.
Most requests get answered. When one doesn't, work through these in order. Each one is free.
Quote your request date and the deadline. A polite chaser often settles it.
Organisations now need a data protection complaints process, and must acknowledge yours within 30 days.
The Information Commissioner's Office is the UK regulator and can look at how they handled it.
You can apply for a court order. It's the last step, so get legal advice first.
Guides for the moments employees most often ask, with what to request and what to expect back.
Answer a few questions and get a letter to copy, email or print. What you type stays on your device.