How to get your HR file from an employer: UK subject access request

Your employer must give you a copy of your personal data within one month

An employer or former employer must give you a copy of the personal data it holds about you when you make a subject access request (SAR), under Article 15 of the UK GDPR. The right has no exception for employment: it covers current staff, former staff, agency workers and job applicants, and it costs nothing in most cases.

According to legislation.gov.uk, Article 15 entitles you to confirmation that your data is being used, a copy of that data, and supporting information: the purposes, the categories of data, who it has been shared with, how long it will be kept, where it came from if not from you, and your rights to correct it and complain. Article 12(5) says this is free unless a request is manifestly unfounded or excessive, in which case the employer may charge a reasonable fee or refuse, and it must be able to show why.

A request needs no special form. You can email HR, write to the data protection officer or send a letter to the company's registered office. The subject access request letter generator writes an employer request that names the records below and works out the reply date from the day your employer receives it.

What you can get: far more than the personnel file

A SAR covers every record that contains your personal data, wherever the employer keeps it, not only the HR file. According to the ICO's subject access Q and As for employers, that includes emails that mention you, CCTV that shows you, and business accounts on messaging or social media platforms the company uses: if the business uses them, it is the controller and must search them when they fall within scope.

The records that usually matter most in a workplace dispute are:

• The personnel file: contract, job description, pay and sickness records, appraisals and warnings.
• Emails and chat messages that mention you, including messages between managers you were never copied into.
• Meeting notes: grievance, disciplinary, redundancy consultation, absence and return-to-work meetings.
• Investigation reports and witness statements about you.
• CCTV and call recordings showing or recording you on given dates.
• Redundancy selection scores and the comments behind them.
• References the employer gave about you or received about you.

The right is to your personal data, not to whole documents. The ICO says a worker copied into an email is entitled to a copy of their personal information, so the employer may disclose some or all of the email. Expect redacted extracts rather than full threads, and ask for the context where a redaction makes a passage meaningless.

What an employer can lawfully withhold

An employer can withhold information only under a specific exemption, applied item by item, and it should tell you it has done so. According to the ICO's Q and As for employers, a blanket refusal because you are in a dispute is not an option. The exemptions that come up most in employment requests are set out in Schedule 2 to the Data Protection Act 2018 and the ICO guidance:

• Other people's data. The employer does not have to disclose information that identifies another person unless that person consents or it is reasonable to disclose without consent. Witness statements are the usual example: the ICO expects a case-by-case decision, often with names redacted.
• Legal professional privilege. Paragraph 19 of Schedule 2 exempts advice from the employer's lawyers and documents prepared for litigation.
• Confidential references. Paragraph 24 exempts a reference given in confidence for your employment, training or education. The ICO says the exemption applies whether the employer gave or received the reference. A reference not given in confidence is disclosable, so ask whether the employer's policy or staff handbook states that references are confidential.
• Management forecasting. Paragraph 22 exempts data processed for management forecasting or planning, but only to the extent disclosure would be likely to prejudice the business, such as a restructure plan not yet announced.
• Negotiations. Paragraph 23 exempts records of the employer's intentions in negotiations with you, such as its maximum settlement figure, while disclosure would be likely to prejudice those negotiations.

Two limits work in your favour. The ICO says the right of access applies during a grievance or tribunal claim, and that a settlement or non-disclosure agreement does not override it, so signing one does not waive your right to ask.

The one-month deadline and when the clock starts

The employer has one calendar month to reply, counted from the day it receives your request. Since 5 February 2026, Article 12A of the UK GDPR, inserted by section 76 of the Data (Use and Access) Act 2025, sets the rules. According to legislation.gov.uk, the month begins with the latest of three dates: when the employer receives the request, when it receives ID it asked for, and when you pay any fee it is allowed to charge.

Three rules change the date:

1. ID. Under Article 12(6) the employer may ask for ID only where it has reasonable doubts about who you are. If you are a current employee writing from your work email, ask what the doubt is before sending copies of documents.
2. Clarification. If the employer genuinely needs more information to find your data, the time between asking you and receiving your answer does not count (Article 12A(5)). The ICO's example stops the clock from 15 May until 18 May and adds four days to the deadline.
3. Extension. The employer can extend by two further months if the request is complex or one of several, but it must tell you, with reasons, within the first month (Article 12A(3)). The ICO says to count the extension as three months from the original start date.

The ICO also says how to count: from the day of receipt to the same date the next month, and where that date falls on a weekend or public holiday, the deadline moves to the end of the next working day. Its example is a request received on Monday 25 November, due by the end of Friday 27 December because 25 and 26 December are bank holidays.

The search only has to be reasonable and proportionate

An employer must search for your data, but the law now limits that duty to a reasonable and proportionate search. Section 78 of the Data (Use and Access) Act 2025 added paragraph 1A to Article 15. According to legislation.gov.uk, you are entitled only to the data and information the employer is able to provide based on such a search, and the change is treated as having come into force on 1 January 2024.

This makes a precise request worth more than a broad one. The ICO says a request is not excessive just because it asks for a large amount of information, but an employer facing "all data since 2015" can argue that searching every mailbox is not proportionate. Give it the search terms it needs:

• the date range, such as 1 March 2026 to the present;
• the people most likely to have written about you, such as your line manager, the HR adviser and the investigating officer;
• keywords such as your name, nickname, initials and employee number;
• specific events, such as the grievance meeting on a given date.

Naming these makes a thin reply harder to defend, because the employer cannot claim it did not know where to look.

What to ask for and how often it is withheld

Name each category you want in the request, so the reply can be checked against a list. This table sets out the common items, why each one helps in a workplace dispute, and how often an exemption applies, based on the ICO employment guidance and Schedule 2 to the Data Protection Act 2018, checked on 27 September 2026.

Ask the employer to say which exemption it relied on for each withheld item. That gives you something specific to challenge.

Using a SAR alongside an employment tribunal claim

A SAR does not pause or extend the time limit for an employment tribunal claim, so start the ACAS process on its own timetable. According to ACAS, you must notify it for early conciliation within your time limit, and "going through grievance, disciplinary or appeal procedures does not change your time limit". Waiting for a SAR reply is the same.

The time limit changes on 1 October 2026. According to ACAS, most claims currently have a limit of 3 months minus 1 day from the date the problem happened, such as the date of dismissal. From 1 October 2026, the limit for most claims rises to 6 months minus 1 day, but only where the time limit starts on or after that date. GOV.UK's Employment Rights Act 2025 timeline confirms the change on 1 October 2026, with 9 November 2026 for breach of contract claims in Scotland. Regulation 10 of the Employment Tribunal (Extension of Time Limits) Regulations 2026 says the longer limits do not apply where the relevant act happened before 1 October 2026, so a dismissal on 30 September 2026 stays on the 3-month limit.

Notifying ACAS pauses the time limit until early conciliation ends. ACAS says conciliation can last up to 12 weeks and, if you notified within your time limit, you have at least 1 month from the date you receive the certificate to claim. Statutory redundancy pay and equal pay claims already have a 6-month limit; the redundancy pay calculator gives the statutory figure to check against your payslip.

Timing the SAR well still helps. Send it as soon as a dispute starts, ideally during your notice period while you still have access to work email to confirm dates and names. The one-month reply then usually arrives while conciliation is running, when the documents can shape a settlement. The ICO says the right applies even while a tribunal claim is under way.

Worked example: a dismissal in November 2026

This example uses real 2026 and 2027 dates and the England and Wales bank holidays, and the dates come from the SAR letter generator with these inputs: employer, England or Wales, request received 4 November 2026, ID asked for and received 9 November 2026, clarification asked 16 November and answered 18 November 2026.

Suppose HR does not reply, you chase on 15 December, and HR emails on Friday 18 December 2026 promising the data "in the new year" and then goes quiet. Counting 3 months from that last meaningful contact gives Thursday 18 March 2027 as the date to complain to the ICO by. Meanwhile you should notify ACAS well before 2 May 2027; the SAR does not move that date.

Had the employer not asked for ID or clarification, the reply would have been due on Friday 4 December 2026, and the latest extended date would have been 4 February 2027.

If the reply is late or incomplete, chase and then complain to the ICO

A late or incomplete reply should be chased in writing first, then complained about to the employer and, if that fails, to the Information Commissioner's Office (ICO). According to the ICO, if more than a month has passed without a response you should send a follow-up email or letter, and you should raise a complaint with the ICO within three months of your last meaningful contact with the organisation.

1. Chase the day after the deadline. Quote the date the employer received your request and the due date, and ask for the data within 7 days.
2. Complain to the employer. Since 19 June 2026, section 164A of the Data Protection Act 2018, inserted by section 103 of the Data (Use and Access) Act 2025, requires an employer to make it easy to complain about its handling of your data and to acknowledge a complaint within 30 days. For an incomplete reply, list the missing items from your request and ask which exemption covers each.
3. Complain to the ICO with copies of your request, the reply, the chaser and the employer's response. Keep within the 3-month window from your last meaningful contact.

The ICO says it cannot act as your representative or award compensation. For compensation, or a court order to comply, you would need to go to court, and the ICO suggests getting independent legal advice first.