Employers and Subject Access Requests: why getting early legal advice can save time, cost and risk

For many employers, a subject access request can arrive at the worst possible moment: during a grievance, in the middle of disciplinary action, after a dismissal, or when a dispute appears to be building. It is tempting to treat the request as an administrative inconvenience. In reality, it is a legal process with strict obligations, short timescales and real consequences if handled badly. A calm, well-managed response can reduce risk and protect your position. A rushed or incomplete response can create further problems, including regulatory attention, reputational damage and avoidable cost.

What is a subject access request?

A subject access request, often shortened to SAR, is a request made by an individual for access to the personal data an organisation holds about them. In simple terms, it is the right to ask: what information do you hold on me, where did it come from, what are you using it for, and who has it been shared with? Under the UK data protection regime, employers must respond without undue delay and usually within one month. The request does not have to follow a special format and does not need to use the words “subject access request” to be valid. If it is clear that someone is asking for their own personal information, the request needs to be taken seriously and handled properly. Guidance for employers issued by the Information Commissioner’s Office (ICO) explains that a worker can make a request verbally or in writing, including through informal channels, and that employers should have internal processes in place so such requests are recognised and escalated promptly.

In an employment setting, the information caught by a SAR can be wider than many employers expect. It may include HR records, appraisals, attendance records, payroll data, grievance and disciplinary documents, emails, messages, meeting notes, CCTV footage and internal correspondence where the individual is identified or identifiable. That does not mean everything must automatically be handed over in full. Employers may need to consider the rights of other people, legal exemptions, relevance and the practical scope of the search. However, assuming that only the formal HR file is covered is a common and costly mistake.

Who has the right to make a subject access request?

This right is not limited to current employees. It can apply to current staff, former employees, job applicants, workers and, in many cases, contractors or sub-contractors if the business holds personal data about them. The important point is not the label attached to the working relationship, but whether the organisation is controlling (that is holding) or processing that individual’s personal data. If it is, the right of access may arise. That means businesses should be careful not to dismiss a request simply because the individual is not on the payroll as an employee. Commentary from employment and data protection specialists consistently notes that the right extends beyond traditional employees and should be approached on the basis of data protection status rather than employment status alone.

Do subject access requests only apply to employees?

No. If a business holds personal data about a sub-contractor, consultant, agency worker or applicant, that individual may have the right to ask for access to that data. In practice, this may include onboarding documents, vetting information, correspondence, performance concerns, payment records, site access logs or complaint records. The scope will depend on the circumstances and on what personal data is actually held. This is one reason why employers and businesses should avoid a narrow, employment-only view of SARs. A mistaken refusal based on status alone can quickly become a compliance issue.

How should employers deal with a subject access request?

The first step is recognising the request quickly. Because a SAR can be made informally and without any special wording, managers and HR teams need to know what one looks like and where to send it internally. Once identified, the business should confirm the deadline, consider whether identity checks are needed, define the scope of the search, preserve relevant material and assess whether any clarification is needed.  Although employers need to respond without delay and within one month of receiving the request, that period can sometimes be extended where the request is complex or where multiple requests have been made. The ICO also makes clear that employers can ask for clarification in appropriate cases, but this must be handled carefully and not used as a tactic to delay.

This is often where professional advice becomes valuable. The challenge is not simply finding documents. Employers may need to decide whether information contains third-party personal data which will or may need to be redacted, whether any exemption may apply, how far searches need to go, how to treat witness evidence, and how to keep the response proportionate while still compliant. These are not always straightforward judgement calls, particularly where there is an ongoing grievance, disciplinary process or threatened tribunal claim. A poorly judged response can hand an unhappy individual another cause for complaint.

What happens if you fail to respond appropriately?

If an employer ignores a SAR, responds late, conducts an inadequate search, discloses the wrong information or withholds material without a proper basis, the individual may complain to the ICO and potentially also seek a solution in court. The ICO has repeatedly warned that employers who misunderstand or underestimate SAR obligations expose themselves to enforcement action such as reprimands and, in some cases, fines. Public reporting has also highlighted the volume of SAR complaints received by the regulator and the increase in enforcement attention where organisations fail to meet deadlines or mishandle requests.

There can also be significant practical consequences. A mishandled request can undermine an employer’s credibility in parallel employment proceedings, increase legal spend, distract management time and damage internal trust. In some situations, the real cost is not simply the SAR itself, but the effect it has on a wider dispute. Employers who respond carefully, consistently and with a clear record of their reasoning are usually in a much stronger position than those who improvise under pressure.

Why it is worth getting professional advice

Most employers do not deal with subject access requests every day, and even well-run businesses can come unstuck when a request arrives at a sensitive moment. Taking advice at an early stage can help you identify the true scope of the request, put sensible search parameters in place, apply the right exemptions, protect third-party rights and respond in a way that is both compliant and proportionate. Just as importantly, it can help you avoid turning a manageable issue into a more expensive dispute. In short, the cost of getting advice is often far lower than the cost of getting it wrong.

How Fraser Dawbarns can help

Our solicitors have a track record of advising clients on the appropriate way to respond to an SAR.  For individual advice contact David Osborne on 01553 666610 or davidosborne@fraserdawbarns.com or your existing contact within our employment law team.

“Thank you very much for your clarification and advice.  I found the information provided to be clear and succinct, and it helped us with a much better understanding of the SAR and the potential disclosure considerations”. – Client, 2026

How To Contact Us:

To contact a member of our team, you can fill in our online enquiry form, email info@fraserdawbarns.com, or call your nearest office below. If you’d like to speak to a member of our team at one of our offices across Norfolk and Cambridgeshire, visit our offices page.

Wisbech: 01945 461456

March: 01354 602880

King’s Lynn: 01553 666600

Ely: 01353 383483

Downham Market: 01366 383171

This article aims to supply general information, but it is not intended to constitute advice. Every effort is made to ensure that the law referred to is correct at the date of publication and to avoid any statement which may mislead. However, no duty of care is assumed to any person and no liability is accepted for any omission or inaccuracy. Always seek advice specific to your own circumstances. Fraser Dawbarns LLP is always happy to provide such advice.