What Data Protection Rights Do You Have at Work?

Employers routinely collect and use significant amounts of personal information about their employees, workers and job applicants.

This can include information relating to:

• Recruitment
• Salary and benefits
• Performance
• Attendance
• Sickness absence
• Disciplinary matters
• Grievances
• Workplace investigations
• Equality monitoring
• Occupational health
• CCTV
• Emails and communications
• IT and device monitoring
• Training
• Pension arrangements
• Termination of employment

Employers must handle this information in accordance with UK data protection law.

The principal legal framework includes the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as subsequently amended, including by the Data (Use and Access) Act 2025.

What Are the Data Protection Principles?

Organisations handling personal information must comply with the fundamental data protection principles.

Personal data should be:

• Processed lawfully, fairly and transparently
• Collected for specified, explicit and legitimate purposes
• Adequate, relevant and limited to what is necessary
• Accurate and kept up to date where necessary
• Kept for no longer than necessary
• Protected using appropriate security measures

There is also an important accountability principle, meaning the organisation responsible for processing personal information must be able to demonstrate compliance with its data protection obligations.

What is Personal Data?

Personal data is information relating to an identified or identifiable living person.

In an employment context, this can include straightforward information such as:

• Your name
• Home address
• Work email address
• Telephone number
• Employee number
• Salary
• Job title

It can also include information that says something about you, such as:

• Performance assessments
• Disciplinary records
• Grievance allegations
• Managers' comments about you
• Absence records
• Workplace investigation findings
• CCTV footage
• Access-card records
• Monitoring information
• Information about workplace decisions concerning you

Whether information is personal data depends on its substance and context, not simply on whether your name happens to appear in a document.

What is Special Category Data?

Some personal information receives additional legal protection because of its particularly sensitive nature.

Special category data can include information about:

• Health
• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data used for identification
• Sex life
• Sexual orientation

Employers processing this information generally need both a lawful basis for processing and an additional legal condition permitting the use of special category data.

Health information, for example, should only be collected where there is a proper reason and should be handled particularly carefully.

What Information Should Your Employer Give You About Your Data?

Employers must generally be transparent about how they collect and use workers' personal information.

This is commonly done through an employee privacy notice or similar privacy information.

The information should normally explain matters including:

• Who is responsible for your personal data
• How to contact the organisation
• How to contact the Data Protection Officer where applicable
• What personal information is collected
• Why the information is being used
• The lawful basis relied upon
• Any relevant legitimate interests
• Who the information may be shared with
• How long different categories of data will be retained
• Whether information may be transferred internationally
• Your rights under data protection law
• Your right to complain to the Information Commissioner's Office

Where information is collected directly from you, privacy information should generally be provided when it is collected.

Where an employer obtains information about you from another source, the information must generally be provided within a reasonable period and normally no later than one month, subject to applicable exceptions.

What Data Protection Rights Do Employees Have?

Depending on the circumstances, your data protection rights can include:

• The right to be informed
• The right of access
• The right to correct inaccurate information
• The right to erasure in qualifying circumstances
• The right to restrict processing
• The right to object to certain processing
• Rights relating to data portability
• Rights relating to certain automated decisions
• The right to complain to the ICO

Not every right applies in every situation.

For example, an employer may sometimes have a legal obligation to retain information even where an employee asks for it to be deleted.

What is a Subject Access Request?

A Subject Access Request, commonly called a SAR or DSAR, allows you to ask an organisation for access to personal information it holds about you.

The right is to your personal data, rather than a general right to obtain every document held by your employer.

A SAR can help you understand:

• What personal information is being processed
• Why it is being processed
• Who it has been disclosed to
• Where the information came from
• How long it may be retained
• Whether the information being held about you is accurate

An employer responding to a SAR will normally need to provide copies of relevant personal information together with supplementary information required by data protection law.

What Information Can You Request Through a Subject Access Request?

Depending on what your employer holds, a request could cover personal information contained in:

• Personnel files
• Employment contracts
• Performance reviews
• Disciplinary records
• Grievance records
• Redundancy documentation
• Capability procedures
• Workplace investigations
• Emails
• Teams, Slack or other workplace messages
• Relevant WhatsApp messages
• Meeting notes
• Payroll records
• Bonus and commission records
• Holiday records
• Training records
• Occupational health information
• Recruitment records
• CCTV footage
• Call recordings
• Access-card records
• Relevant monitoring information
• Communications with third parties

Information does not necessarily have to be stored centrally within HR.

Relevant personal information held by managers, IT systems, external processors or other departments may potentially fall within the scope of a request.

However, employers are now expressly required to conduct reasonable and proportionate searches, rather than unlimited searches regardless of cost, effort or relevance.

Can You Request Every Email That Mentions Your Name?

Not automatically.

A subject access request gives you access to your personal information, not necessarily every document containing your name or email address.

For example, an email might include your name in:

• A recipient list
• A signature
• A meeting invitation
• A passing reference
• A copied email chain

That does not necessarily mean the entire contents of the email are personal data relating to you.

The important question is whether the information actually relates to you.

Relevant considerations can include whether the information:

• Describes you
• Evaluates your performance or conduct
• Records allegations concerning you
• Contains an opinion about you
• Is being used to make a decision about you
• Records how you have been treated
• Concerns your health or circumstances
• Is used to monitor or manage you
• Has a material effect on you

An employer may therefore provide relevant extracts or redact information rather than simply handing over every document returned by a search for your name.

How Do You Make a Subject Access Request?

There is no compulsory form or specific wording required.

A SAR can generally be made:

• In writing
• By email
• Verbally
• Through another communication method

You do not need to use the phrase "Subject Access Request" or refer specifically to the UK GDPR.

Your request simply needs to make it clear that you are asking for access to your own personal information.

For example, you could request personal information relating to:

• A disciplinary investigation
• A grievance
• A redundancy process
• Performance concerns
• A particular manager's decisions about you
• A specified period of employment

Your employer may provide a standard SAR form to make the process easier, but you do not generally have to use it for the request to be valid.

Can Your Employer Ask You to Clarify Your Request?

Yes, where clarification is reasonably required.

This is particularly relevant where a request is very broad or the employer holds a significant volume of information about you.

Following changes introduced by the Data (Use and Access) Act 2025, an organisation can pause the response period while waiting for clarification where clarification is reasonably necessary to identify the information or processing covered by the request.

This is known as stopping the clock.

The employer cannot simply insist that you narrow every SAR as a matter of routine.

If clarification is genuinely required, the response period pauses when clarification is requested and resumes after the necessary clarification is received.

How Long Does Your Employer Have to Respond to a SAR?

An employer should respond without undue delay and generally within one month.

The precise starting point can depend on circumstances such as:

• When the request is received
• When necessary identity information is received
• When an applicable fee is paid
• Whether the clock has been lawfully paused for clarification

The employer can extend the period by up to two additional months where this is necessary because of the complexity or number of requests.

If an extension is used, the employer should normally inform you within the initial one-month period and explain why additional time is required.

Can Your Employer Ask You to Prove Your Identity?

Yes, where this is reasonably necessary.

An employer should ensure that personal information is not accidentally disclosed to the wrong person.

It can therefore request evidence needed to confirm your identity.

However, the request should be reasonable and proportionate.

An organisation should not demand excessive identification where it already knows who you are.

Where identity verification is genuinely required, the statutory response period generally begins once the necessary information has been received.

Does it Cost Money to Make a Subject Access Request?

Usually, no.

An employer should normally respond to a SAR free of charge.

A reasonable administrative fee can potentially be charged where:

• The request is manifestly unfounded
• The request is excessive
• Additional copies of information already supplied are requested

Any fee should reflect reasonable administrative costs and should be capable of justification.

Can Your Employer Refuse a Subject Access Request?

In limited circumstances.

An employer may refuse to act on a SAR where it can demonstrate that the request is manifestly unfounded or excessive.

This is not a general power to reject a request simply because responding will take time or because the employer finds the request inconvenient.

Factors potentially relevant to whether a request is excessive can include:

• Repetition of substantially identical requests
• Significant overlap with information recently provided
• The nature and volume of the information
• Whether the burden is disproportionate in the particular circumstances

Employers should assess requests individually and should be able to explain and document their decision.

Can Information Be Withheld From a SAR?

Yes.

The right of access is important but it is not absolute.

Data protection legislation contains exemptions and restrictions that may allow or require an employer to withhold some information.

Depending on the circumstances, these can include information involving:

• Legal professional privilege
• Certain management forecasting or planning
• Crime and taxation
• Confidential references in circumstances covered by an exemption
• Information concerning another individual
• Other statutory exemptions

The existence of an exemption does not necessarily justify withholding an entire document.

An employer should consider whether relevant personal information can still be provided after redacting protected information.

What if the Information Includes Personal Data About Someone Else?

A workplace document can contain personal information about several people.

Your right of access does not automatically entitle you to unrestricted access to another person's personal information.

The employer may need to consider:

• Whether the other individual has consented
• Whether disclosure without consent would be reasonable
• The nature of the information
• Any duty of confidentiality
• Your right of access
• The other person's privacy rights

In many cases, information identifying another person can be redacted while your own personal information is provided.

The employer should be able to justify the approach it takes.

Can Your Employer Refuse a SAR Because You Have Started a Grievance or Tribunal Claim?

No, not simply for that reason.

A SAR and Employment Tribunal disclosure are separate legal processes.

The fact that:

• You have raised a grievance
• You are considering legal proceedings
• You have started an Employment Tribunal claim
• Your employer believes you want the information for litigation

does not by itself remove your right of access.

The employer must still consider the SAR in accordance with data protection law and rely on a valid exemption if particular information is withheld.

Does a SAR Replace Employment Tribunal Disclosure?

No.

A Subject Access Request and legal disclosure serve different purposes.

A SAR concerns your rights to access your own personal data.

Disclosure in Employment Tribunal or court proceedings can require parties to disclose documents relevant to the legal dispute, even where those documents are not the claimant's personal data.

This means that:

• Some documents may be disclosable in litigation but not through a SAR
• Some personal data may be available through a SAR but irrelevant to Tribunal disclosure

The two procedures should not be treated as interchangeable.

What Rights Do Job Applicants Have?

Data protection law applies during recruitment as well as after employment begins.

Employers and recruiters may process information including:

• CVs
• Application forms
• Interview notes
• Assessment scores
• References
• Qualification checks
• Right-to-work information
• Criminal record information where appropriate
• Equality monitoring information
• Recruitment correspondence

Applicants should be provided with appropriate privacy information explaining how their information will be used.

Employers should not retain unsuccessful candidates' information indefinitely simply because it might be useful in the future.

Retention periods should be based on a legitimate purpose and reviewed appropriately.

Can an Employer Keep Your CV for Future Vacancies?

Potentially, yes.

An employer may have a legitimate reason for keeping recruitment information for a period after the recruitment exercise has ended.

For example, it may wish to:

• Defend a potential recruitment claim
• Consider the applicant for another appropriate vacancy
• Meet regulatory requirements
• Maintain appropriate recruitment records

However, personal information should not normally be kept indefinitely without justification.

The employer should determine an appropriate retention period and explain relevant retention practices in its privacy information.

What Rights Do Former Employees Have?

Data protection obligations do not end automatically when employment ends.

Employers may legitimately need to retain some information about former employees.

Possible reasons include:

• Tax obligations
• Payroll records
• Pension administration
• Defending potential legal claims
• Regulatory obligations
• Employment references
• Record-keeping requirements

However, employers should not retain an entire personnel file indefinitely simply because the individual once worked for the organisation.

They should determine:

• What information still needs to be retained
• Why it needs to be retained
• The lawful basis for retaining it
• How long it should be kept
• When it should be deleted or anonymised

ICO employment guidance confirms that employers should have appropriate retention arrangements and should erase or anonymise worker information when it is no longer needed.

Can a Former Employee Ask for Their Data to Be Deleted?

Potentially.

The right to erasure allows individuals to request deletion of personal information in certain circumstances.

However, it is not an absolute right.

An employer may still be entitled or required to retain information where, for example, it is necessary:

• To comply with a legal obligation
• To establish, exercise or defend legal claims
• For another lawful purpose recognised by data protection law

An employee therefore cannot automatically require their complete personnel record to be deleted immediately after leaving employment.

Can Employers Monitor Employees?

Potentially, but employee monitoring must comply with data protection law.

Monitoring might include:

• CCTV
• Email monitoring
• Internet usage
• Telephone recordings
• Computer activity
• Access-card systems
• Location tracking
• Productivity monitoring
• Biometric systems

An employer should normally be clear about:

• Why monitoring is necessary
• What information is being collected
• How the information will be used
• Who will have access to it
• How long it will be retained
• Whether there is a less intrusive way to achieve the same purpose

Except in unusual circumstances where covert monitoring can be justified, workers should normally be informed about workplace monitoring.

Can Your Employer Keep Monitoring Data Indefinitely?

No.

Monitoring information should not be retained for longer than is necessary for the purpose for which it was collected.

Employers should have appropriate retention periods and regularly review whether the information is still needed.

Information should not simply be retained indefinitely "just in case" it becomes useful later.

Can a Settlement Agreement Stop You From Making a Future SAR?

Generally, no.

A settlement agreement or non-disclosure agreement cannot override your statutory right of access under data protection law.

If a settlement agreement attempts to prevent a worker from exercising their right to make a Subject Access Request, that part of the agreement is likely to be unenforceable under data protection legislation.

Signing a settlement agreement does not itself waive your statutory information rights.

What if a Settlement Agreement Refers to an Existing SAR?

Settlement agreements sometimes contain wording dealing with an existing SAR or other ongoing workplace processes.

Such wording needs to be considered carefully.

Even where the parties agree how an existing request will be dealt with, a settlement agreement cannot simply extinguish statutory data protection rights that the law does not permit an individual to waive.

Any clause dealing with:

• Withdrawal of an existing SAR
• Future Subject Access Requests
• ICO complaints
• Data deletion
• Confidentiality
• Ongoing processing of employee information

should therefore be reviewed carefully before the agreement is signed.

Can an Employer Reject a SAR Because You Agreed Not to Make One?

A previous promise not to make a SAR does not automatically give the employer a lawful basis to refuse the request.

The employer must still deal with the request under data protection law.

If it considers the request manifestly unfounded or excessive, it would need to establish that conclusion under the applicable statutory test rather than simply relying on a settlement clause.

ICO guidance specifically states that a settlement or non-disclosure agreement cannot override a worker's right of access.

What Can You Do if Your Employer Does Not Respond Properly?

If you believe your employer has failed to deal properly with your personal information or Subject Access Request, it can be sensible to raise the matter directly first.

You may wish to:

• Ask why information has been withheld
• Ask which exemption is being relied upon
• Challenge unreasonable redactions
• Ask for missing information
• Ask the employer to correct inaccurate information
• Use the employer's data protection complaints procedure
• Raise the matter with the Data Protection Officer where applicable

If the issue remains unresolved, you can consider making a complaint to the Information Commissioner's Office.

Depending on the circumstances, court remedies may also be available where data protection rights have been breached.

When Should You Seek Advice About Workplace Data Protection?

Data protection issues can become particularly important where there is already an employment dispute.

Advice may be useful where:

• You are involved in a grievance
• You are facing disciplinary proceedings
• You believe managers have exchanged inappropriate information about you
• Workplace monitoring is involved
• You are concerned about medical information
• You have made a Subject Access Request
• Your employer has refused or heavily redacted your SAR
• You are negotiating a settlement agreement
• You are involved in discrimination proceedings
• An Employment Tribunal claim is being considered
• Confidential information has been disclosed
• Your personal information may have been used unlawfully

A Subject Access Request can be useful in an employment dispute, but it should be used with a clear understanding of what the right of access does — and does not — entitle you to receive.