Subject access request: what an employer must give, and by when

An employee emails their line manager and asks for "everything you hold about me". No form, no legal phrasing, no mention of data protection. That is a subject access request, the clock has started, and the manager it landed with has almost certainly not told anyone.

This article sets out how long you have, how hard you must look, what you may lawfully withhold and where each exemption comes from. It covers the position in the United Kingdom and is general information rather than legal advice.

Most of these requests fail on process, not on law: nobody owned it, so the month ran out. See how New Dynamics workflows give each step an owner and a due date, so a request sitting in a manager's inbox becomes a tracked task on the day it lands.

What counts as a subject access request

Article 15 of the UK GDPR gives a person the right to "confirmation as to whether or not personal data concerning him or her are being processed", access to that data, and supplementary information: the purposes, the categories of data, the recipients, the envisaged storage period, the source and the existence of automated decision-making. Article 15(3) requires you to "provide a copy of the personal data undergoing processing".

There is no prescribed form. The ICO's subject access request Q and As for employers states that "the UK GDPR does not set out formal requirements for a valid request. Therefore, a worker can make a SAR verbally or in writing, including by social media." Workers "can make requests to any part of your organisation, and they do not have to direct it to a specific person or contact point", and a request "does not have to include the phrases 'subject access request', 'right of access' or 'Article 15 of the UK GDPR'". Its examples are the ones HR teams see weekly and rarely log: "Please send me my HR file." "Can I have a copy of the notes from my last appraisal?"

Access dominates the regulator's casework. The ICO's published data protection complaints data sets record 24,132 completed cases for April to June 2026, of which 9,576 carry "Art 15 - Right of access" as the primary reason, close to two in five. The data set has no employment sector, so no official source publishes how many involved an employer. For the wider picture, see our HR statistics hub.

The deadline, and what changed on 5 February 2026

Much published advice is now out of date. Section 76 of the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, inserted a new Article 12A into the UK GDPR. It took effect on 5 February 2026 under the Act's Commencement No. 6 Regulations (S.I. 2026/82), whose regulation 4 keeps the old rules for requests received earlier.

One month, from the relevant time. Article 12A(1) defines "the applicable time period" as "the period of one month beginning with the relevant time": the latest of when you received the request, when you received any identity information you asked for, and when any fee was paid. The ICO's guidance on responding to a request, last updated on 8 December 2025, says to count "forward to the end of the same date in the following month", moving to the next working day if that falls on a weekend or bank holiday.

Two further months, by notice. Article 12A(3) lets you "extend the applicable time period by two further months" for "the complexity of requests made by the data subject, or the number of such requests". Article 12A(4) requires the notice to "be given before the end of the period of one month beginning with the relevant time" and to "state the reasons for the delay". Miss that first month and you lose the extension, not just the deadline.

Stop the clock. Where you "reasonably require further information in order to identify the information or processing activities to which a request under Article 15 relates", Article 12A(5) provides that the period from the day you ask to the day you receive the answer "does not count towards" either the month or the window for an extension notice. The ICO puts it as: "the time limit pauses on the day you request clarification and resumes on the day after you receive it."

It is not a delaying tactic. Article 12A(6) gives one example, "where the controller processes a large amount of information concerning the data subject", the ICO says you "should not ask for clarification on a blanket basis", and it closes the loophole: "you cannot force a person to narrow the scope of their request, as they are entitled to ask for all their information."

The ICO's employer page carries a banner saying this guidance "is under review and may be subject to change" because of the Act. Where the page and the amended legislation diverge, the legislation governs.

How hard you have to look

Section 78 of the same Act inserted Article 15(1A), which limits the entitlement to what the controller "is able to provide based on a reasonable and proportionate search". Section 78(5) states that "the amendments made by this section are to be treated as having come into force on 1 January 2024", so this one bites retrospectively.

The ICO's guidance on finding and retrieving information sets the test: reasonable efforts, but you "are not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to the information". The burden is yours: "You must be able to show why a search is unreasonable or disproportionate."

Archives and backups are in scope, because "there is no technology exemption from the right of access". Genuinely deleted records are not. And an email the requester was copied into is not automatically theirs, because the right "only applies to the personal information in the email that relates to the person making the SAR". How long you still hold any of it is a separate decision, covered in our post on employee records retention.

The exemptions an employer actually uses

Exemptions are applied document by document, with a recorded reason, never declared over a whole file. Four sit in Part 4 of Schedule 2 to the Data Protection Act 2018, which restricts Article 15(1) to (3).

Legal professional privilege (paragraph 19). Covers information for which "a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings". The ICO's example is advice taken on an investigation into a suspected leak, withheld when the worker asks what the lawyers said.

Management forecasts (paragraph 22). Covers data "processed for the purposes of management forecasting or management planning" where disclosure "would be likely to prejudice the conduct of the business or activity concerned". The ICO calls this the management information exemption on its employer page, which is the same exemption under a different name. Its example is a planned restructure where staff ask whether they are in a selection pool and the employer neither confirms nor denies.

Negotiations (paragraph 23). Covers "records of the intentions of the controller in relation to any negotiations with the data subject" where disclosure would prejudice them. The ICO reads this narrowly: it is likely to apply only while negotiations are live, and a fresh request once a settlement is agreed will usually have to be answered.

Confidential references (paragraph 24). Covers "a reference given (or to be given) in confidence" for employment, education or training, a volunteer placement, an office or the provision of a service. It applies whether you gave or received the reference, but only where it really was given in confidence, so say in your handbook how you treat them.

Other people in the file

Most of the redaction work in a real response is not an exemption at all. Paragraph 16 of Part 3 of Schedule 2 provides that Article 15(1) to (3) does "not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information". Paragraph 16(4) extends that to information identifying someone as the source.

It is not a blanket shield. The obligation returns if that person consents, or if "it is reasonable to disclose the information to the data subject without the consent of the other individual", and paragraph 16(3) lists what you must weigh: the type of information, any duty of confidentiality owed, the steps you took to seek consent, whether the person can consent, and any express refusal.

The ICO adds a factor the statute does not spell out, that "it is more likely to be reasonable to disclose information about an employee acting in a professional capacity than a private citizen". So a manager's written assessment of the requester is usually disclosable, while a witness statement given on an assurance of confidentiality, where redaction would not conceal its author, usually is not. Who can open which record in the first place is covered in our post on access levels for HR data.

Charging, and refusing

You normally cannot charge. Article 12 requires the information and any action to be "provided free of charge", and the ICO states that "in most cases, you cannot charge a fee to comply with a SAR". Two exceptions exist: further copies after a first response, and a request that is manifestly unfounded or excessive.

For those, Article 12(5) offers a choice of charging "a reasonable fee taking into account the administrative costs" or refusing to act, then adds the sentence that settles most arguments: "The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request." The ICO notes that section 12(1) of the Data Protection Act 2018 lets the Secretary of State cap such fees by regulations, but "at present, there are no regulations in place", so there is no official maximum to quote.

The ICO's threshold for manifestly unfounded is intent, not volume: the worker "clearly has no intention to exercise their right of access", or the request "is malicious in intent and is being used to harass your organisation". Manifestly excessive means "clearly or obviously unreasonable", judged on "whether the request is proportionate when balanced with the burden or costs involved". Volume alone is neither. The ICO describes an employer that refused a batch of requests from recently redundant staff as a coordinated campaign, could not show the purpose was disruption, and was told to comply.

The trap: a request made during a grievance or a tribunal claim

A request that arrives in the middle of a dispute looks tactical, and often is. It is still valid, and the ICO is unambiguous: "You cannot simply refuse to comply because the worker is undergoing a grievance or tribunal process, and you believe they intend to use their personal information to obtain information for potential litigation." If you withhold, you "must demonstrate what exemption you are using and why".

Tribunal disclosure does not discharge it. The ICO points out that a litigation bundle may not hold all of the worker's personal information, that it went to their legal representative rather than to them, and that you may hold material never disclosed or not yet in existence at the time. Nor does a settlement: "Signing a settlement or non-disclosure agreement does not waive a worker's information rights."

Run the two tracks separately, with one owner each, and do not let the dispute timetable set the data protection deadline. Our post on HR compliance covers how parallel obligations like these fall over.

Frequently asked questions

How long do you have to respond to a subject access request?

One month from the relevant time in Article 12A(1) of the UK GDPR: the latest of the date you received the request, the date you received any identity information you asked for, and the date any fee was paid. You can extend by two further months for complexity or a number of requests, but only by giving notice with reasons inside the first month.

Can you pause the deadline to ask the employee what they want?

Yes, within limits. Article 12A(5) stops the clock from the day you ask for information you reasonably require to identify what the request covers until the day the answer arrives. It applies only where clarification is genuinely needed, and you cannot make an employee narrow a request they are entitled to make in full.

Does a subject access request have to be in writing?

No. The ICO's employer guidance says a worker can make one "verbally or in writing, including by social media", to any part of the organisation, and without using the words "subject access request". Train managers to forward anything that reads like a request for a person's own information on the day it arrives.

Can an employer refuse a request from someone in a grievance?

Not on that basis. A grievance or tribunal process does not remove the right, and disclosure already made in litigation does not discharge the request. You may apply a specific exemption to specific documents, but you must be able to say which exemption and why.

Do you have to disclose witness statements and references?

Often not, but for different reasons. A reference given in confidence is exempt under paragraph 24 of Schedule 2 to the Data Protection Act 2018. A witness statement is not automatically exempt: you weigh the third party rules in paragraph 16, and it is usually withheld where it was given on an assurance of confidentiality and redaction would still reveal the author.

Can you charge for a subject access request?

Not in most cases. A reasonable fee for administrative costs is allowed only for further copies, or where the request is manifestly unfounded or excessive, and the burden of showing that sits with you. No regulations currently set a maximum fee.

Your next step: find out who would receive the request

1. Ask three managers what they would do with an email saying "please send me everything you hold about me". The honest answers are your real response time.
2. Name one owner and one shared mailbox, and tell every manager where to forward a request.
3. Write down which systems a search covers: HR system, email, shared drives, chat channels, archives and any paper file.
4. Draft an extension notice that states its reasons, and a clarification request that explains the clock has paused.
5. Record the exemption and the reason against each document you withhold, as you withhold it.

For the policy this process belongs in, read and download our employee data protection guide. The guide is free to read, and the PDF uses our short download form. Where requests arrive alongside grievances, our post on HR case management software covers keeping the two files apart.

Want every request logged, owned and dated from the moment it arrives, with the deadline calculated for you? Book a New Dynamics demo and bring a real request you have had to answer. You can also email contact@new-dynamics.com.