All UK employers need to understand how to handle subject access requests (SARs)
- After being overlooked for a promotion, an employee shares concerns that the process was biased and they raise a subject access request (SAR) for copies of appraisal reviews, interview notes and information linked to the decision process.
- An individual facing a disciplinary procedure raises a subject access request (SAR) to see all communication, including emails, HR records and statements from colleagues.
These are just two of the potential scenarios that might mean an organisation faces a subject access request (SAR) from an employee; there are many more!
What is a subject access request (SAR)?
Everyone has the right to request that an organisation provide them with access to all personal and supplementary information that is held about them. This is known as “right to access” (UK GDPR, 2025) and allows individuals to understand what data is being stored, why this data is helpful to the organisation, and ensure that they are using the data lawfully. Subject access requests (SARs) should usually be completed within one month.
How does an employee make a subject access request (SAR)?
A subject access request (SAR) can be initiated verbally or in writing. There is no specific format that an individual should use to make this request; it just needs to be clear that they are asking for access to their personal data. However, individuals can use the subject access request (SAR) form found on the ‘Information Commissioner’s Office’ (https://ico.org.uk/).
Management (and employees) should be aware and trained in the internal procedure for actioning a subject access request (SAR) along with using and storing data.
Can a third party make a subject access request (SAR)?
A subject access request (SAR) can also be made by a third party on behalf of an individual, and it is the organisation’s responsibility to verify that permission has been obtained from the subject and request ID if needed. The one-month timeline for fulfilling the subject access request (SAR) does not begin until this verification is completed.
Can you charge for a subject access request (SAR)?
You cannot usually charge for a subject access request (SAR) except in exceptional circumstances where significant volumes of data are involved or where there are multiple requests from the same subject. Organisations can ask for specifics that may help them to narrow down the type of information wanted, but they cannot refuse if everything is requested
Does a subject access request (SAR) include digital and paper filing?
The subject access request (SAR) should include all of the subject’s personal data held both digitally and in hard format, such as in a paper filing.
What is personal data?
A CV with name, address and previous employment information. Yes, that’s personal data.
Payroll information, including bank account details, tax code and salary, would be personal data.
A photo of the team event day was published on the intranet. Yes, even photos can count as personal data too!
The Information Commissioner’s Office (ICO) states that:
“’personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” (ICO, 2025)
Where an organisation has employees, it definitely has personal data about them. A name, employee number, address, and work location are all personal data. This means that even a name in an email address is considered to be personal data.
As well as personal data, employers will most likely also have special category data about employees. This is data that is of a more sensitive nature, such as race, religion and health data, and UK GDPR expects this to be treated with a greater level of protection.
Whether the person can be identified directly or indirectly, this data is all considered personal data.
Personal data includes:
- A name
- An identification or employee number
- Location or address data
- An online identifier
- One or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity
Special category data includes:
- Race
- Ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data (where this is used for identification purposes)
- Health data
- Sex life or sexual orientation
- Criminal convictions or offences
(ICO, 2025)
For more information on data categories, visit the ICO website.
