Employee subject access requests

You have the right to ask your employer for a copy of the personal information it holds about you, and the employer must reply without delay and within one month of receiving the request. If the request is complex or you have sent several, it can extend that by up to two more months. This is called a subject access request (SAR), and it covers HR files, appraisal notes and emails about you. The ICO is the regulator.

How to ask

There is no required form. The ICO’s guidance for employers says a worker can make a request verbally or in writing, including through social media, and can send it to any part of the organisation. It does not have to say “subject access request”, “right of access” or “Article 15”. It only has to make clear that you want your own personal information. The ICO gives examples that count:

• “Please send me my HR file.”
• “Can I have a copy of the notes from my last appraisal?”
• “What information do you hold on me?”
• “Can I have a copy of the emails sent by my manager to HR regarding my verbal warning?”

A short email to HR or your line manager works, and it gives you a dated record. If you ask by phone or in person, note who you spoke to and when. Many organisations name a person or email address for requests in their privacy notice, and using it helps avoid delay.

What to put in the request

The ICO suggests including a subject line saying “subject access request”, the date, your name and contact details, and your employee number if you have one. Say what you want, and add dates if that helps them find it. State how you would like to receive it, such as by email or in print.

You can ask for everything the employer holds about you. You might not get everything, and you might receive a lot you do not need. Being specific usually gets a faster and more useful reply. Employers may ask you to clarify, but the ICO says they should only do so if it is genuinely needed and they hold a large amount about you, and the time limit is paused until you answer.

What an employer can withhold

An employer has to apply exemptions case by case, and has to justify and document its reasons. It can also refuse a request that is manifestly unfounded or manifestly excessive. The exemption that comes up most at work concerns information about other people.

If a document names a colleague, the employer does not have to disclose that part unless the person consents or it is reasonable to disclose without consent. The ICO’s examples include witness statements in a disciplinary matter and whistleblowing reports. An employer may black out the names, or hold back a statement given in confidence if redaction would not hide who wrote it. Notes about your own performance can still be released with other people’s details removed.

When you are in a dispute

The ICO’s guidance covers several points that come up when work relationships break down:

• A settlement or non-disclosure agreement does not waive your information rights.
• A grievance or tribunal process is not a reason to refuse.
• Documents given to your lawyer or included in a tribunal bundle do not end the employer’s duty, because the bundle may not hold all your data and may not have been given to you.

The exemptions still apply, so you may not get everything. A request can still be a sensible early step if you are in the middle of a grievance or disciplinary process and want to see what is on your file. Tribunal claims have strict time limits, which the time limits guide sets out, so do not wait for a reply before taking advice from ACAS, a union or a solicitor.

If the reply is late or incomplete

Raise your concern with the employer first, in writing, and say what is missing. The ICO says the employer should take the complaint seriously and try to resolve it. If that fails, you can complain to the ICO, which can give the employer advice and ask it to put things right.

The ICO notes on both of the pages above that its guidance is under review because of changes made by the Data (Use and Access) Act, so check the ICO website for updates before you rely on the details of timing.