Subject access request to employer

Yes, you have the right to do this. It is known as a subject access request, or SAR, and it is one of the most important rights available to individuals under data protection law.

Legal basis:

The right is set out in Article 15 of the UK General Data Protection Regulation (UK GDPR), retained in domestic law after Brexit and supplemented by the Data Protection Act 2018. Every individual has the right to obtain confirmation from a data controller (in this case your employer) as to whether their personal data is being processed, and if so, to receive a copy of that data together with certain supplementary information.

What you are entitled to receive:

You are entitled to a copy of all personal data your employer holds about you. This can include emails to and about you, HR records, performance reviews, disciplinary records, sickness absence records, CCTV footage featuring you, payroll records, internal notes, occupancy or access logs, and any other information that relates to you as an identifiable individual. You are also entitled to be told the purposes of the processing, the categories of data held, who it has been or will be shared with, how long it will be kept, and the source of the data if it was not collected directly from you.

How to make the request:

1. You can make a subject access request in writing, by email, or even verbally, though writing is always advisable for evidence purposes.
2. You do not need to use any particular form or magic words, but it helps to state clearly that you are making a subject access request under Article 15 of the UK GDPR.
3. You do not need to give a reason for your request.
4. The request is free of charge in most cases.

Time limit for the employer to respond:

Your employer must respond without undue delay and in any event within one calendar month of receiving your request. This can be extended by a further two months if the request is complex or if you have made multiple requests, but the employer must tell you about the extension and explain why within the first month.

Practical tips:

It is worth being as specific as possible about what you want, for example specifying particular date ranges, types of records, or departments. This can make it easier for your employer to comply promptly and reduces the risk of them claiming the request is too broad. That said, you are perfectly entitled to ask for everything.

If your employer holds data that includes other people's personal data, they may redact those parts to protect third party rights, but they cannot use that as a blanket excuse to withhold everything.

What to do if the employer does not comply:

If your employer fails to respond, provides an incomplete response, or refuses without valid justification, you have the right to complain to the Information Commissioner's Office (ICO). The ICO can investigate and take enforcement action. In more serious cases, you may also be able to bring a claim for compensation in court under section 167 of the Data Protection Act 2018 if you have suffered damage, including distress, as a result of a breach of your data protection rights.

One thing to bear in mind:

Employers sometimes try to delay or push back on SARs, particularly where there is an underlying employment dispute or grievance. If you are in that situation, a well-drafted and clear SAR can be a very powerful tool, both to obtain evidence and to test how seriously your employer takes its legal obligations.