Any UK employer can receive a subject access request from an employee, and the one month response clock starts the moment it lands, whether that is by email, letter, or a message buried in a grievance letter. Many HR teams still treat these as rare, awkward events. Staff ask for their personal data more often than most businesses expect, and getting the response wrong carries real regulatory risk as well as an annoyed employee.
What A Subject Access Request Covers For A UK Employer
A subject access request gives someone the right to ask what personal data an organisation holds about them, and to get a copy of it. For employers, that means emails mentioning the employee, HR notes, appraisal records, disciplinary files, CCTV footage if they appear in it, and anything else that counts as their personal data, not just the obvious HR file. It does not matter whether the information sits in a formal HR system or in a manager’s inbox. If it identifies the employee and relates to them, it is potentially in scope.
The One Month Deadline, And When You Can Extend It
Employers have one calendar month to respond, starting from the day the request is received, not the day someone gets round to reading it. That is a tight window once you account for annual leave, slow email triage, or a request landing with the wrong department. Complex or numerous requests can earn an extra two months, but you must tell the employee within the first month that you are extending and explain why. Letting the deadline pass in silence is a route to a complaint on file with the regulator.
Working Out What You Can Withhold
Not everything in a file has to go to the employee. Information about other people mixed in with theirs, such as a colleague’s name in a witness statement, may need to be redacted or withheld to protect that third party. Legally privileged material, such as correspondence with a solicitor about potential litigation, can also be excluded. For third-party data the decision turns on whether disclosure is reasonable once you weigh that person’s interests, and embarrassment or inconvenience to the business does not count as a reason to withhold.
Common Mistakes That Turn A Routine Request Into A Complaint
Most problems come from the same handful of errors. Treating the request as hostile and stalling for time, when the employee’s reason for asking generally does not matter, even if the request arrives in the middle of a grievance. Searching only the obvious HR system and missing records sitting in a manager’s personal inbox or an old shared drive. Redacting too much, too cautiously, because nobody wants to be the person who released something sensitive. Missing the deadline because nobody owned the response internally. The ICO’s guidance has long expected a reasonable and proportionate search, which the Data (Use and Access) Act 2025 also codifies, so record what you searched and why. Each of these can turn a routine administrative task into something that ends up with the Information Commissioner’s Office reviewing your handling of the request, which is a far worse outcome than the original ask.
Building A Process That Does Not Rely On Memory
The organisations that handle these well have a documented process: a single point of contact who logs the request on day one, a clear search procedure covering every system where employee data might live, a standard approach to redaction, and a checklist for the final review before anything goes out. A process like this is the kind of control that gets tested in a wider information security framework. ISO 27001 expects you to identify and meet your legal requirements for protecting personal data, and a working SAR process is practical evidence of that, which is why it comes up in ISO 27001 compliance work.
Getting Ahead Of The Next Request
If your business has never mapped out where employee personal data actually lives, now is a sensible time to do it, well before a request forces the issue under deadline pressure. A proper review of data flows, retention, and access controls catches the gaps that otherwise surface halfway through a one month countdown.
If you want help building a data protection process that holds up under real deadlines, get in touch via Paul Reynolds’s profile to talk through where your current approach needs tightening.
