Making a subject access request (SAR) to your employer under UK GDPR
A subject access request (SAR) is your right under UK GDPR to ask an organisation for a copy of the personal data it holds about you, and it applies to current and former staff alike. You don't need any particular form of words. It can be made verbally or in writing and doesn't have to say 'subject access request'. There is normally no fee, and your employer must respond without undue delay and within one calendar month, extendable by up to two more months only where the request is genuinely complex.
Written by the team behind Agent Sam, our refunds specialist. This guide is general information about UK law, reviewed for accuracy.What a SAR is and who can use it
A subject access request (SAR) is your right under UK GDPR to ask an organisation for a copy of the personal data it holds about you. Employees and ex-employees use it often: during a grievance, a disciplinary, a redundancy, or simply to see what's on file. Your employer counts as a data controller, and the right applies to current and former staff alike.
No magic words, and no fee
You don't need to use any particular form of words. A SAR can be made verbally or in writing, and it doesn't have to contain the phrases 'subject access request' or 'Article 15'. It just has to be clear that you're asking for your own personal information. You can send it to any part of the organisation, though many employers publish a dedicated contact or email for these requests, and using it speeds things up. Putting the request in writing and dating it is sensible, because it starts and evidences the clock.
There is normally no fee. Your employer must respond without undue delay and within one calendar month of receiving the request. That period can be extended by up to a further two months where the request is complex or you've made several requests, but the employer has to tell you about any extension, and why, within the first month.
What can be withheld, and if they ignore you
You won't always receive absolutely everything. Some information can be withheld under exemptions. For example, data that would reveal personal information about another person who hasn't consented, certain confidential references, or material covered by legal privilege. The employer should still release the rest and shouldn't use an exemption as a blanket excuse to refuse.
If your employer ignores the request, misses the deadline, or hands over an obviously incomplete response, you can complain to the Information Commissioner's Office (ICO), which regulates data protection and is free to contact.
Send a precise SAR that's hard to delaySam drafts a precise, dated SAR that specifies the categories and date range you want. That makes it harder to delay and easier to challenge if the response falls short.£5 launch price (normally £9.99)Start my letterCommon questions
Can I make a SAR to my employer, and does it cost anything?
Yes. A subject access request is your right under UK GDPR, and it applies to current and former staff alike. There is normally no fee. Your employer counts as a data controller and must respond to a valid request.
Do I have to use special wording?
No. A SAR can be made verbally or in writing and doesn't have to contain the phrases 'subject access request' or 'Article 15'. It just has to be clear that you're asking for your own personal information. Putting it in writing and dating it is sensible, as it starts and evidences the clock.
How long does my employer have to respond?
Without undue delay and within one calendar month of receiving the request. That period can be extended by up to a further two months where the request is complex or you've made several requests, but the employer must tell you about any extension, and why, within the first month.
Can my employer withhold information?
Some information can be withheld under exemptions, for example data revealing another person's personal information without their consent, certain confidential references, or material covered by legal privilege. But the employer should release the rest and shouldn't use an exemption as a blanket excuse to refuse.
What if my employer ignores my SAR?
If your employer ignores the request, misses the deadline, or hands over an obviously incomplete response, you can complain to the Information Commissioner's Office (ICO), which regulates data protection and is free to contact.