Subject Access Request (DSAR) at Work: How to Get Your Employment Data

A workplace dispute often turns on documents you have never seen. Investigation notes, emails between managers, HR comments on a grievance - those records sit with the employer. A Data Subject Access Request (DSAR) is one of the main ways individuals can require a copy of the personal data held about them under UK data protection law.

This guide is for workers in England and Wales who want a practical map of what a DSAR is, how to send one, what to expect back, and how it fits next to evidence gathering for a tribunal claim. It is legal information, not legal advice.

Law status - last updated 9 July 2026: The Data (Use and Access) Act 2025 (DUAA 2025) changed parts of the subject-access regime. A "stop-the-clock" rule now lets an employer pause the one-month deadline while it reasonably verifies your identity or asks you to clarify a wide request (Article 12A UK GDPR, in force 5 February 2026), and the search an employer must run is expressly limited to what is "reasonable and proportionate" (Article 15(1A) UK GDPR). Separately, from 19 June 2026 data controllers must operate a formal complaints procedure under section 164A of the Data Protection Act 2018, acknowledging a complaint within 30 days.

What is a workplace DSAR?

Under Article 15 of the UK GDPR and the Data Protection Act 2018, you have a right of access to your personal data. A DSAR is simply the formal exercise of that right.

"Personal data" means information that relates to you as an identifiable person. In an employment context that often includes:

• emails and messages that are about you or identify you
• HR files, appraisals and performance notes
• grievance and disciplinary investigation records
• absence and occupational health records that identify you
• some CCTV stills or logs where you appear

It does not automatically include every internal document about the business. Pure strategy notes with no personal data about you are outside the right of access.

The ICO's public guidance on the right of access is the practical authority on how organisations should respond.

Why DSARs matter for employment disputes

People preparing a claim use DSARs because employers hold most of the contemporaneous record. A careful request can surface:

• emails you were not copied on that discuss your dismissal or performance
• notes of meetings that differ from what you were told orally
• investigation materials that show what was considered (and what was not)

A DSAR is not a fishing expedition for every document that might help a claim. Tribunals later run a separate disclosure process. The DSAR is a data-protection right you can use early - including before you file an ET1 - while the one-month clock is still useful.

Always keep your tribunal time limit in view. A DSAR does not pause the tribunal deadline. Only steps such as notifying ACAS Early Conciliation do that in the usual way.

How to make a DSAR

There is no mandatory form. You can email HR, the data protection officer, or the address in the employer's privacy notice. Keep it in writing.

A clear request usually covers:

1. Who you are and how to contact you (include enough identity detail for the employer to verify you).
2. That you are making a subject access request under UK GDPR / the Data Protection Act 2018.
3. The data you want - be specific where you can (date ranges, systems, types of document). Broad "everything you hold about me" is valid but often slower.
4. The format you prefer - electronic copies are usually fine.
5. Any third-party context that helps them search (team name, manager, case reference).

You do not have to say why you want the data. Some people choose to say they are preparing a grievance or claim; others keep the request neutral. Either way, stay factual and calm.

Worked example outline

I am making a subject access request under Article 15 UK GDPR for personal data you hold about me. Please provide emails, HR notes, investigation materials and performance records relating to me for the period 1 January 2025 to the date of this request, including material held by [manager name] and HR. Please respond within one month to this email address.

Adapt the dates and systems to your situation. Keep a copy of what you sent and when.

Deadlines, fees and extensions

• Standard deadline: one calendar month from receipt.
• Stop-the-clock: since 5 February 2026 (DUAA 2025, Article 12A UK GDPR) the month does not start - or is paused - while the employer reasonably asks you to confirm your identity or to clarify a broad request. The clock restarts when you reply, so a slow reply simply lengthens the wait.
• Extensions: up to two further months for complex or multiple requests, with reasons given in the first month.
• Fees: free in normal cases. A reasonable fee or refusal is only for manifestly unfounded or excessive requests.

If the employer asks for ID or for clarification, supply what is reasonable promptly - that ends the stop-the-clock pause and starts (or restarts) the one-month deadline.

What employers can withhold

The right of access is wide but not absolute. Common limitations include:

• legal professional privilege on advice from lawyers
• third-party personal data that cannot be disclosed without unfairly affecting someone else (employers sometimes redact other people's names)
• negotiations or other limited exemptions under the Data Protection Act schedule

An employer that redacts heavily should still explain the basis in broad terms. Since the DUAA 2025 reforms, an employer only has to carry out a search that is reasonable and proportionate (Article 15(1A) UK GDPR) - so a focused, specific request is more likely to be met in full than a blanket "everything you hold about me". If the response looks incomplete, you can chase in writing and use the employer's own complaints procedure (data controllers must operate one from 19 June 2026 under section 164A of the Data Protection Act 2018, acknowledging within 30 days), then complain to the ICO, and - if you are already in litigation - raise the issue with the tribunal.

How a DSAR fits with tribunal evidence

Use the DSAR to build a contemporaneous file. Use tribunal evidence practice for what will actually go in a hearing bundle later. Do not assume every DSAR page will be used at the hearing - relevance and reliability still matter.

Practical tips

• Send early if a claim is possible - the one-month response window eats into preparation time.
• List systems you know exist (Outlook, Slack, HR system, shared drives).
• Keep a chronology so when the pack arrives you can map documents to dates.
• Do not rely on the DSAR alone for deadline safety - start ACAS if the time limit is close.
• Preserve what you already have - your own emails and messages remain part of the story.

What to do with the response

When material arrives:

1. Save it in a dated folder.
2. Index key documents by date.
3. Note gaps (meetings with no notes, missing email chains).
4. Cross-check against your own records.
5. Feed the useful items into your claim preparation - narrative, ET1, and later witness evidence.

If nothing useful arrives, the failure itself can be relevant later. Record the request, chases and any refusal reasons.

Key takeaway

A workplace DSAR is a free, statutory way to obtain personal data your employer holds about you, usually within one month. For employment disputes it is often most useful early, alongside - not instead of - ACAS, internal procedures and eventual tribunal disclosure. Keep the tribunal clock separate in your mind: a DSAR helps the paper trail; it does not stop the time limit.