Guide
Subject access request to an employer: what to expect
Updated
An employer is the controller most likely to hold a decade of information about you across a dozen systems, and the one most likely to be in a dispute with you when you ask for it. Both facts change how the request should be framed.
Where the data actually is
The personnel file is the smallest part of it. There is also the HR system, payroll, the email archive, the messaging platform, recruitment records, occupational health, expense and travel systems, building access logs, and any performance or case management tool.
A request for everything is lawful and will reach all of it, eventually. A request that names systems and a date range gets an answer faster and gives the controller far less room to reasonably require further information under Article 12A(5), which since 5 February 2026 is the mechanism that pauses your deadline.
The two exemptions you will meet
Confidential references, under Schedule 2 paragraph 24 of the Data Protection Act 2018. If the point of the request is a reference, expect it to be withheld and aim at the decision record instead.
Legal professional privilege, where the employer has taken legal advice about you. That is a genuine exemption and it is applied properly far more often than not. What it does not cover is everything an employment lawyer has been copied into: privilege attaches to the advice, not to the recipient list.
Identity, and why it rarely bites here
Article 12(6) lets a controller ask for more information where it has reasonable doubts about your identity, and delay dealing with the request until identity is confirmed. Article 12A(2)(b) then restarts the month from the day it receives that information.
An employer holding your payroll record, your contract and your work email has little room for reasonable doubt about who you are. A request from a personal email address by a former employee is a different matter, and answering that question immediately is worth more than arguing about whether it should have been asked.
Keeping it separate from the dispute
A subject access request is not a disclosure exercise and it is not part of a grievance, even when the same facts are behind both. Running them together tends to produce a response that answers the grievance and treats the request as rhetoric.
It also matters for the deadline. A request buried in the fourth paragraph of a grievance letter can genuinely be missed, and the argument about when the relevant time began is one you would rather not need to have.