Subject Access Request to an Employer

The right is the same whether you still work there or left ten years ago, and there is no special form. The ICO tells employers that a request can be made verbally or in writing, to any part of the organisation, without naming a particular person, and without using the words “subject access request” or citing any legislation. Its own examples of a valid request include “Please send me my HR file” and “Can I have a copy of the emails sent by my manager to HR regarding my verbal warning?”.

The ICO’s list of what an employer is likely to be keeping, from its guidance on employment records, is a good checklist to ask against: personnel files, sickness and injury records, disciplinary and grievance records, training records, appraisal or performance review records, payroll information, pension information, interview notes, emails, references, and equality and diversity information.

Ask for the messages, not just the file. This is where requests are most often answered too narrowly. The ICO tells employers that if they use platforms such as Facebook, WhatsApp, Twitter and chat channels on Microsoft Teams for business purposes, they are the controller for what is on them and “must search these platforms for any personal information if it falls within scope”. CCTV of you is your personal data too — where an employer’s system cannot blur other people, the ICO’s own worked example is that it should provide stills with the other identities redacted rather than refuse. An email you were copied into is not automatically all yours, but the ICO is clear that your name and email address in it are, and that a business subject does not stop the rest being about you.

Naming the systems, the people and a date range is the single most useful thing you can do. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

They often arise from the same argument, so it is easy to assume they are stages of one process. They are not, they run on separate clocks, and only one of them gets you your records.

A grievance is how you complain. Acas describes it as a formal way for an employee to raise a problem or complaint to their employer, normally in writing, with a meeting and a right of appeal. It asks your employer to do something about a situation. It does not oblige anyone to hand over documents.

Tribunal disclosure is how documents move once a claim exists. It is ordered by the tribunal, it runs to the tribunal’s rules, and what it produces is a bundle for the case.

A subject access request is neither. It is a data-protection right you can use at any point, before a grievance, during one, after a claim is settled, or with no dispute at all.

The one thing on this page worth acting on today: none of this pauses a tribunal deadline. Acas states plainly that going through grievance, disciplinary or appeal procedures does not change your time limit, and that if those procedures take a long time you still need to notify Acas before the limit runs out. A subject access request does not change it either — and an employer has a month, extendable to three. Most claims currently have to reach Acas within three months minus one day of what happened, though a few have six, and Acas has said the limits increase to six months in October 2026. Work out your own date from Acas rather than from us, and do not wait for the records before you start the clock. In Northern Ireland it is the Labour Relations Agency you notify, not Acas, and the claim goes to an industrial tribunal or the Fair Employment Tribunal.

Acas holds records of its own about your conciliation — and they are not the same thing as your HR file, are covered by legal privilege, and are destroyed sooner than most people expect. If you want those rather than your employer’s records, that is a subject access request to Acas.

These come from the ICO’s subject access request questions and answers for employers, which is written to tell employers what they must do. It is a better thing to quote back than anything written for employees.

A settlement agreement or NDA does not sign the right away. The ICO’s answer is that the right “cannot be overridden by a settlement or non-disclosure agreement”, and that if a settlement agreement limits it, “it is likely this part of the settlement agreement will be unenforceable under data protection legislation”. Signing one does not waive your information rights.

A live grievance, disciplinary or tribunal is not a reason either. An employer “cannot simply refuse to comply because the worker is undergoing a grievance or tribunal process” and believes the information is wanted for litigation. If it wants to hold something back it has to identify an exemption and justify it.

Nor is “we already gave it to you in the tribunal bundle”. The ICO gives four reasons, and the third is the one nobody expects: the bundle may not contain everything the employer holds about you; you may only have been allowed to view it rather than keep a copy; disclosure goes to your legal representative rather than to you, so the employer cannot assume you have it; and there may be material that was not disclosable then or did not exist yet.

Wanting the information for a claim is not, in itself, an abuse of the right. An employer can refuse a request that is manifestly unfounded or excessive, but the bar is real: in an ICO case study, a telecoms company refused a batch of requests from redundant workers it believed were coordinating on Facebook, and the ICO decided it had not demonstrated the purpose was disruption and told it to comply. The ICO’s own worked example of a request an employer may properly refuse on that ground runs the other way: offering to withdraw the request if the employer improves your financial package.

Some things genuinely can be withheld, and knowing which is the difference between a productive complaint and a wasted month. Four exemptions in Schedule 2, Part 4 of the Data Protection Act 2018 do most of the work in employment. They have to be applied case by case and the employer has to be able to justify each one.

References, given or received (paragraph 24). A reference given in confidence is exempt, for employment, training, volunteering, appointment to office or providing a service. The catch that surprises people is that it applies at both ends: the ICO states the exemption “applies regardless of whether you give or receive the reference”, so asking your new employer will not get it either. The lever is the word confidential. The ICO tells employers this only covers references they give in confidence and that they should say so in a privacy statement, staff handbook or policy — so it is fair to ask whether the employer actually treats references as confidential, and where it says so. Where that is unclear the ICO says to decide case by case, weighing your interest in checking the reference is accurate.

Management forecasting and planning (paragraph 22). Where disclosure would be likely to prejudice the business. The ICO’s worked example is a restructure: staff who hear redundancies are coming and ask whether they are in the selection pool can be told that the employer will neither confirm nor deny it. That is a lawful answer here, not evasion.

Negotiations with you (paragraph 23). Records of the employer’s intentions in a negotiation with you, where disclosure would prejudice it — settlement and severance discussions, in practice. This one usually expires, and that is the useful part. The ICO says it is “only likely to apply whilst the negotiations are ongoing”, and its worked example has the employer withhold during the talks and then disclose on a second request after the settlement is agreed, because it could no longer evidence any prejudice. If you were refused mid-negotiation, asking again afterwards is a real option.

Legal professional privilege (paragraph 19). Advice between the employer and its lawyers. Not everything sent to a lawyer — it has to be confidential and made for the dominant purpose of getting or giving legal advice, or for actual or likely litigation.

Other people in your records. Colleagues have rights too, so expect redactions, but an employer must still disclose what it can. The ICO offers a lever worth knowing: in a work context it says the factors include a person’s seniority and role, and that “in general, it is more likely to be reasonable to disclose information about an employee acting in a professional capacity than a private citizen”. A manager’s name blacked out of a decision about you is worth querying. Witness statements given on an assurance of confidentiality are a harder case, and whistleblowing reports are harder still, because the Public Interest Disclosure Act 1998 protects the person who made them. More on when a request can be refused or limited.

This is the one part of the subject worth knowing even if you never make a request. Under section 184 of the Data Protection Act 2018 it is a criminal offence for someone to require you to obtain and hand over certain records about yourself in connection with recruitment, your continued employment, or a contract to provide services. It is called enforced subject access.

Three details do the work. The records covered are defined in Schedule 18 and are broader than most people assume: health records, records of convictions or cautions obtained from the police, and records of certain statutory functions — which includes the Disclosure and Barring Service and the benefits records held by the Secretary of State. A record saying that nothing is held about you counts as one too, so being asked to produce a “nothing recorded” letter is caught as well.

Second, it covers being asked, not only being ordered: section 184(5) catches a person who asks knowing, or being reckless as to whether, it would be reasonable for you to feel obliged to comply. Third, “employment” here is wide, and expressly includes work under a contract for services, apprenticeships, work experience as part of a training course and voluntary work.

An employer wanting a criminal record check has a lawful route to it — a DBS check, a Disclosure Scotland disclosure or an AccessNI check — and section 184(4) says the existence of those routes is why helping to prevent, investigate or detect crime cannot be used to justify demanding your records instead. More on enforced subject access requests, and police records covers which check an employer should be asking for.

What it costs. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies. You do not have to say why you want it, and you should not be asked to justify it.

How long they have. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why. A long employment record is exactly the kind of thing that attracts an extension, so assume three months rather than one if you have been there twenty years.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it. An employer that already knows perfectly well who you are has less room to ask than a stranger would.

Narrowing it down. An employer can ask you to specify what you want, and the clock pauses until you answer — but the ICO says it should only do that where the clarification is genuinely needed and it holds a large amount of information about you, and that if you decline to narrow the request it must still carry out reasonable searches. Answer quickly if you are asked.

If the answer is late or incomplete. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office. Our free subject access request response checker walks through what a complete answer should contain. Note this is a different door from the employment one: a complaint about how your request was handled goes to the ICO, while a complaint about the underlying treatment is the grievance and tribunal route.

If you have not made a request before, what a subject access request is covers what counts as your personal data, and our free letter template is wording you can send yourself at no cost.