How to Handle a Subject Access Request from an Employee

A Subject Access Request (SAR) is an individual's right under UK GDPR to obtain a copy of all personal data you hold about them. Employees submit SARs - sometimes in a personal capacity, sometimes as part of a dispute. Handled poorly, they can escalate a situation. Handled well, they are a manageable process. Here is exactly what to do.

Your legal obligations

You must respond to a SAR within one calendar month of receipt. You may extend by two further months for complex or numerous requests, but must inform the individual within the first month that you are extending and why.

The response must be free of charge. You can only charge a reasonable fee if the request is manifestly unfounded or excessive, or for further copies of previously provided data.

Step 1 - Confirm receipt and identity

• Acknowledge the SAR in writing immediately - this establishes your 30-day window clearly
• Confirm the identity of the requester - you may ask for reasonable verification if there is doubt
• Check whether the request is clear - you can ask for clarification, but the clock does not stop while you wait for it

Step 2 - Identify and compile all relevant data

Search systematically across all systems and formats where you hold data about this individual:

• HR records - contract, payroll records, absence and performance data
• Email - including emails where they are the subject, not just sender/recipient
• CRM or customer systems where they also appear as a customer
• Paper files - appraisal notes, disciplinary notes, reference requests
• Messaging platforms (Teams, Slack) where their personal data may appear

Step 3 - Consider exemptions and redactions

Not all data must be provided. You may redact or withhold:

• Information about other individuals (redact their personal data unless they consent or it is reasonable to disclose)
• Legally privileged material (correspondence with your solicitor about the individual)
• References given in confidence (references you gave about the individual to third parties are exempt; references received about the individual may need to be disclosed, subject to the referee's identity being protected)
• Information relating to ongoing criminal investigations

Step 4 - Respond and record

• Provide the data in a commonly used electronic format unless the individual requests otherwise
• Include a cover explanation of what you have included, what you have withheld and why
• Do not alter, delete or destroy any data once a SAR has been received - this could be construed as obstruction
• Record the SAR, your response date, what was provided and what was withheld in your data protection records

Back to all guides