What Is a Subject Access Request?
A Subject Access Request — commonly referred to as a SAR — is a formal legal request made under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It gives every individual the right to request a copy of all personal data that an organisation holds about them.
In an employment context, that means every email that mentions your name, every performance note made by a line manager, every HR file entry, every Slack or Teams message in which you are discussed, every appraisal note, every informal record made about your conduct or capability — and yes, every internal message in which a manager has expressed an opinion about you, your performance, or your future at the company.
Your employer cannot refuse a valid SAR without legal justification. They have 30 days to respond. And the information they are required to provide may surprise them as much as it surprises you.
What Personal Data Your Employer Holds
Employers hold far more data about their employees than most people realise. Under UK GDPR, personal data is any information that identifies you or relates to you as an identifiable individual. In a workplace context that includes:
Emails to, from, or about you — including internal emails in which you are discussed but were not copied in Instant messages on platforms such as Slack, Microsoft Teams, or Google Chat where your name appears HR system records — disciplinary notes, performance ratings, attendance records, sickness records Handwritten or typed notes from meetings — including one-to-ones, appraisals, and disciplinary hearings WhatsApp or text messages sent by managers on personal devices if those messages relate to you in a work context References provided about you — including internal references between managers Documents relating to redundancy selection, performance improvement plans, or capability processes The scope is broad. An employer who tells you they hold very little data about you is almost certainly wrong — and may be in breach of their obligations if they respond to a SAR incompletely.
How to Write a Subject Access Request
A SAR does not need to be complex or legally drafted to be valid. It simply needs to be clear, written, and addressed to the correct person — typically the HR department, the Data Protection Officer if one is named, or the company's registered address.
A straightforward SAR might read as follows:
"I am writing to make a Subject Access Request under Article 15 of the UK General Data Protection Regulation and Section 45 of the Data Protection Act 2018. I request a copy of all personal data held about me by [Company Name], including but not limited to emails, instant messages, HR records, performance notes, meeting notes, and any other documents in which I am identified or discussed. I would like this data provided in a commonly used electronic format. Please confirm receipt of this request and provide the data within the statutory 30-day period."
You do not need to give a reason for making the request. You do not need to tell your employer what you are looking for. You are entitled to make the request simply because you are entitled to make it.
Targeting Your Request Effectively
A broad SAR will return a large volume of data — much of which may not be relevant to your situation. If you are in a live dispute, facing redundancy, on a PIP, or have reason to believe internal decisions are being made about you, you can target your request to increase its effectiveness:
Specify a date range — for example, the six months prior to a disciplinary process beginning Name specific individuals — ask for all data held about you that involves communications from or to named managers Reference specific processes — ask specifically for data relating to any redundancy selection exercise, performance review, or capability process in which you were included Reference specific platforms — ask explicitly for data held on Slack, Teams, WhatsApp, or any other communication platform used by the business A targeted request is harder for an employer to claim is disproportionate — one of the most common grounds used to resist or limit a response.
How Employers Try to Limit What They Disclose
Not every employer will respond fully and promptly. The most common tactics used to limit disclosure include:
Redaction of third-party names — employers are permitted to redact the names of third parties who have not consented to disclosure. However, they cannot redact names simply because the content is embarrassing or damaging. Where a manager's name appears in a document about you, that name is generally disclosable. Claiming disproportionate effort — an employer may argue that fulfilling the request would require disproportionate effort. This is a limited exemption and cannot be used simply because the volume of data is large. Delaying beyond 30 days — the response deadline can be extended by a further two months in complex cases, but the employer must notify you of the extension within the first 30 days and explain why. Claiming legal professional privilege — communications between the employer and their solicitors regarding your case may be withheld on grounds of legal professional privilege. This is a legitimate exemption, but it does not extend to general HR communications. Simply not responding — a failure to respond to a SAR is a breach of UK GDPR and can be reported to the Information Commissioner's Office. What to Do If Your Employer Does Not Comply
If your employer fails to respond within 30 days, responds incompletely, or refuses your request without adequate legal justification, you have two immediate options:
Complain to the Information Commissioner's Office (ICO). The ICO is the UK's data protection regulator. A complaint can be submitted online and the ICO has the power to investigate, issue enforcement notices, and impose fines. Employers take ICO complaints seriously — the reputational and financial consequences of a finding against them are significant. Apply to the court. Under Section 167 of the Data Protection Act 2018, you can apply to the court for an order compelling the employer to comply. This is a less common route but available where the ICO route is too slow for a live dispute. Using What You Find
The data disclosed through a SAR can be significant evidence in employment tribunal proceedings. Internal emails discussing redundancy selection criteria may reveal that the process was not genuinely fair. Messages between managers discussing your performance may reveal that the decision to dismiss was made before any formal process began. Notes from HR meetings may contradict the account given in a disciplinary hearing.
Where the data reveals evidence of discrimination, bad faith, or procedural failures, it should be preserved carefully and provided to a qualified employment law solicitor before any further action is taken.
"I submitted a SAR during my redundancy consultation. The emails I received showed my manager had already told HR I was being let go six weeks before the consultation started. My solicitor said it was exactly the kind of evidence that changes a case." — Anonymous MRR user
Your employer holds more data about you than you think. You have the legal right to see it.
Use our free Legality Checker to assess your position: myredundancyrights.co.uk/legality-checker
Employer and employee guidance: myredundancyrights.co.uk/employer