What is a subject access request?
Under the UK GDPR and Data Protection Act 2018, you can request access to your personal data held by an organisation, including an employer. This is a right to personal data, not an unrestricted right to every email, file or document containing your name. Relevant information might be in HR files, performance notes, emails, work messages or meeting records. Some material may concern other people, be exempt or not be your personal data.
How to make a request
You can make a request verbally or in writing and do not need to cite legislation or explain why. For a clear record, send a written request to HR or the data protection contact, for example:
“Please treat this as a subject access request for personal data you hold about me. In particular, please search relevant HR records and work communications concerning my redundancy selection between [dates]. I would prefer an electronic response. Please acknowledge receipt.”
Include enough identifying details to help locate data. You can request all your personal data or narrow the period, people or systems to focus the search. A narrow request may produce a more useful response, but it does not automatically defeat an exemption. The employer may reasonably ask for identity verification or clarification in certain circumstances.
What happens next
The usual deadline is without undue delay and within one calendar month, not necessarily 30 days. In complex cases or where there are multiple requests, it may be extended by up to two further months; you should be told of the extension and reasons within the first month. A fee is not usually charged, though limited exceptions apply. Employers must conduct a reasonable search, but may withhold legally privileged material, apply other relevant exemptions or protect third-party personal data where disclosure would not be reasonable. Third-party names are not categorically disclosable or categorically withheld. Private-device messages may be relevant where processed for the employer, but their presence is not guaranteed.
If the response seems incomplete, ask the employer what searches and exemptions were applied, and explain what appears missing. You can complain to the ICO, which may consider the complaint; an ICO complaint does not guarantee a fine or disclosure. Court remedies may also be available. A SAR is not a substitute for employment tribunal disclosure and does not pause tribunal deadlines. Preserve any relevant response securely and seek independent advice on a live dispute.
👉 Check your position: https://myredundancyrights.co.uk/legality-checker
Official guidance: ICO right of access; ICO subject access guidance; ICO guidance for employers.