How should employers handle an employee subject access request?
Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
Recognising a request
The ICO says a worker can make a subject access request (SAR) verbally or in writing, including through social media, to any part of the organisation. It does not need to use particular wording; a request such as 'please send me my HR file' is enough. The ICO recommends a designated person, team and email address for SARs, and making sure staff know what to do when they receive one.
Time limits and searches
The ICO's guidance, updated in July 2026 for the Data (Use and Access) Act 2025, says employers must respond without undue delay and within one month of receipt. This can be extended by up to two further months if the request is complex or the person has made a number of requests, but the person must be told within the first month.
If clarification is reasonably required, the clock stops until it is received. Employers must make a reasonable and proportionate search, which can include business use of email, messaging apps, Microsoft Teams chats and CCTV.
Withholding information
Exemptions must be applied case by case, with reasons documented. In employment, the ICO highlights:
- information about other people, such as witnesses, unless they consent or it is reasonable to disclose
- confidential references, given or received
- legal professional privilege
- management forecasting or planning, such as a planned restructure
- records of the employer's intentions in ongoing negotiations with the requester
- requests that are manifestly unfounded or excessive, which is a high threshold
Grievances, tribunals and settlements
A SAR must still be answered if the worker is raising a grievance or bringing a tribunal claim. The ICO says a settlement or non-disclosure agreement cannot override the right of access. If information is refused, employers must explain why and tell the person they can complain to the employer, complain to the ICO or seek to enforce the right through the courts.
The law
“a reference given (or to be given) in confidence for the purposes of…”
“any duty of confidentiality owed to the other individual…”
Sources
General information for employers in Great Britain, not legal advice. Check the official sources for your situation.
What employers can do
- Train managers and HR to spot a SAR in any form and pass it on the same day
- Log the date received, any ID or clarification requests, and the response deadline
- Search all relevant systems, including email, chat tools, HR software and CCTV
- Redact third-party information where disclosure would not be reasonable, and record your reasoning
- Send a clear, secure response with the supplementary information and complaint rights
- Have a complaints process for people unhappy with how their SAR was handled
Related answers
- How should employers handle a grievance? Employers should try to resolve concerns informally where appropriate. If a formal written grievance is raised, the Acas Code expects a meeting without unreasonable delay, the right to be accompanied, any necessary investigation, a written decision without unreasonable delay, and an appeal heard impartially by a manager not previously involved where possible.
- Can employers monitor their staff? Yes, but the ICO says monitoring must be lawful, fair and transparent under data protection law. Employers need a clear purpose, a lawful basis, the least intrusive method that achieves it, and must tell workers about it. A data protection impact assessment is required for high-risk monitoring, and covert monitoring is justified only in exceptional circumstances.
- What makes a settlement agreement valid? To waive employment tribunal claims, a settlement agreement must be in writing, relate to particular complaints or proceedings, and follow advice to the employee from an insured, relevant independent adviser who is named in the agreement. It must also state that the statutory conditions are satisfied. A general 'full and final settlement' clause is not enough.