Employee Has Submitted a Subject Access Request: Employer Guide
An employee has asked for their data. What now? A subject access request, or SAR, is a request by an individual to access their personal data. It may arrive during a grievance, disciplinary, sickness case or tribunal dispute. It can be inconvenient, but it is a separate data protection obligation that should be handled methodically.
At a Glance: Managing Employee SARs
- No Formal Wording Required: A request does not need to cite "UK GDPR" or "SAR" to be legally binding and trigger deadlines.
- One-Month Statutory Clock: Employers must comply within one calendar month unless an extension for complexity is formally issued.
- Personal Data vs Company Records: Employees are entitled to their own personal data, not necessarily every company record mentioning their name.
- Redaction & Third Parties: Third-party identities must be safeguarded and redacted unless consent is provided or disclosure is reasonable.
Does the request have to say “subject access request”?
No. A person does not have to use legal terminology or a special form. A request for copies of personal information may be a SAR even if it is made in an ordinary email or conversation. Record the date received and clarify scope where appropriate without using clarification as an automatic reason to delay.
How long do we have to respond to a SAR?
The usual deadline under UK GDPR is one month, calculated according to the applicable rules. Certain complex requests, or numerous requests from the same person, may permit an extension of up to two further months, but the person must be informed within the initial period and given reasons. Specific timing rules can apply where identity verification or clarification is reasonably needed.
UK GDPR SAR Workflow: Receipt Logging, Proportionate Searches, Redaction, and Secure Disclosure
What information is covered in a SAR?
A SAR concerns the requester’s personal data, not necessarily every document that mentions them or every document in an employer’s possession. Relevant data may appear in emails, HR systems, messages, meeting notes and other records. You may need to search across several systems and consider what information is actually personal data about the requester.
Do we have to disclose emails about the employee?
Potentially, yes, where they contain the employee’s personal data and no relevant exemption applies. However, information about other people may require careful consideration, redaction or another lawful approach. Do not automatically withhold all internal correspondence or disclose other people’s personal data without assessment.
Can we charge for or refuse an excessive request?
UK data protection law permits limited responses to requests that are manifestly unfounded or excessive, but the threshold is not simply that the request is large, inconvenient or connected to a dispute. Document the reasoning and obtain specialist advice before refusing or charging a fee.
What about legal advice and tribunal documents?
Some information may be exempt, including certain legally privileged material, but exemptions are specific and should be applied carefully. A live tribunal claim does not automatically suspend SAR obligations. Coordinate the SAR response with legal advisers where litigation is ongoing.
Practical steps for employers
Log the request and deadline; confirm who is responsible; identify likely data sources; preserve relevant records; search proportionately; review exemptions and third party data; prepare the response securely; and keep an audit trail of decisions. Avoid deleting material simply because a request has arrived.
How Nectar HR can help
Nectar HR can support the HR side of a SAR, including identifying relevant personnel records, organising a defensible search and coordinating with your data protection lead or legal advisers.
Got an employee problem?
Nectar HR can support the HR side of a SAR, including identifying relevant personnel records, organising a defensible search and coordinating with your data protection lead or legal advisers.
You don't have to navigate employee data requests alone. Tell us what has happened.
Tell Us What's Happened
Share a quick summary below and an experienced UK HR adviser will contact you confidentially.