Subject access request: how employees use a SAR at work

Worried your employer is hiding vital evidence? Facing a disciplinary, unfair dismissal, or discrimination at work is stressful, but a Data Subject Access Request (DSAR) forces your boss to hand over your personal data. It is a powerful way to uncover the facts for a grievance or tribunal claim. To build a solid case, it is highly recommended to find an employment solicitor to manage your request and review the documents.

Key Takeaway: Can my employer refuse my employee subject access request?

No, an employer cannot simply refuse your request because you are in a dispute. They can only withhold specific data under strict legal exemptions, such as legal professional privilege or if the request is manifestly excessive.

Uncovering the truth is your right, here is how to use this tool effectively in the workplace.

What is a subject access request under UK GDPR?

A Subject Access Request (SAR) gives you the legal right to access your personal data.

It can help you find out:

• What information your employer holds about you
• Where that information came from
• How it is being used
• Who it has been shared with

Under the UK GDPR and the Data Protection Act 2018, employers must comply with valid requests.

Importantly, signing a settlement agreement or NDA does not remove your right to access your personal data.

UK GDPR: The UK General Data Protection Regulation is the main legal framework governing how organisations collect, use, and protect personal data.

• Sets rules for handling personal information
• Applies to all organisations processing employee data
• Requires lawful, fair, and transparent data use

Legal update:

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its provisions are being commenced in phases across 2025 and 2026, including changes to UK data protection and privacy law.

How to make a subject access request to your employer

You can make a Data Subject Access Request (DSAR) verbally or in writing, including via social media or internal work chats. You do not need to use formal legal phrasing or cite the UK GDPR, you just need to state clearly that you want your personal information.

Key points to keep in mind:

• Clarification: If your request is very broad (e.g., asking for 20 years of data), your employer can ask you to narrow it down.
• Timeframe pause: The statutory one-month deadline to respond is paused until you provide that clarification.
• No refusal: If you refuse to narrow the scope, your employer cannot just ignore you, they must still carry out reasonable searches to comply.

What you can request in an employee dsar request

You can request a wide range of documents in an employee subject access request. This includes standard HR files, internal communications, and even multimedia records.

A DSAR allows you to obtain:

• Your main HR file and performance appraisals.
• Internal emails and witness statements from investigations mentioning your name.
• CCTV footage of yourself.
• Personal data processed on workplace channels used for business (like WhatsApp, Microsoft Teams, or Slack).

To clarify what is typically accessible versus what might be restricted, review the table below:

E.g., an employer refused a leisure centre worker’s request for CCTV footage of their damaged car due to third-party privacy. The ICO advised providing redacted still images instead.

The time limit for a subject access request

Employers must respond to a subject access request without delay and within one month of receiving it.

If your dsar request is highly complex or if you have submitted multiple requests, the employer can extend the time limit by up to two additional months.

As mentioned earlier, if the employer genuinely requires clarification to locate the information and processes a large amount of data about you, the time limit is paused until you provide that clarification.

Can your employer refuse a dsar request?

Employers can only refuse a DSAR in limited, legally defined circumstances. Each exemption must be applied case by case.

• Manifestly unfounded: malicious or abusive requests (e.g. used to pressure a settlement)
• Manifestly excessive: clearly disproportionate or overly burdensome requests
• Third-party data: information about others (e.g. witnesses) where redaction is not enough
• Whistleblowing reports: may be withheld to protect whistleblowers or investigations
• Confidential references: often exempt if treated as confidential by both parties
• Legal privilege: confidential legal advice between employer and lawyers
• Crime/taxation: can be withheld if it risks an ongoing investigation
• Management information: internal planning data (e.g. redundancy strategy)
• Ongoing negotiations: sensitive settlement or severance discussions during talks

What happens if you are unhappy with the SAR response?

If you believe your employer has unfairly withheld information, excessively redacted documents, or failed to respond within the statutory timeframe, you should first raise the issue internally through a grievance procedure.

If this does not resolve the matter, you can escalate your complaint to the Information Commissioner’s Office (ICO), which is an independent regulator responsible for enforcing data protection law.

• First step: raise a formal internal grievance with your employer
• Second step: escalate to the Information Commissioner’s Office (ICO) if unresolved
• Role of the ICO: investigate complaints and require employers to comply with data protection obligations

For instance,

In a real case involving a telecommunications company, the employer refused DSARs from redundant staff in a Facebook group, claiming they were manifestly unfounded and disruptive. The ICO found no evidence of malicious intent and ordered the employer to comply.

FAQs

How to make a subject access request?

You can request your data verbally or by email (no formal form needed). It is best to email HR asking for all personal data held about you and keep proof of your request.

How long does a subject access request take?

One month from receipt, extendable by two months if complex or multiple requests. The deadline can pause if clarification is needed.

What can I request in a subject access request?

All personal data about you, including HR files, payroll, emails, reviews, and CCTV where you are identifiable, but not data about other employees.

A DSAR lets employees access workplace data for claims like dismissal or discrimination. Employers must respond within 1 month (sometimes longer), may use exemptions or delays, and it can be escalated to the ICO if needed.

This guide provides general information only and does not constitute legal advice.

KEY TAKEAWAYS:

• What is a subject access request under UK GDPR? A legal right to access your personal data, often used to gather evidence in workplace disputes.
• Time limit: Employers must respond within one month, extendable by two months if complex.
• Can an employer refuse a DSAR? Only in limited cases, such as legal privilege or manifestly unfounded requests.