Subject Access Request to employer

Letter to an employer's Data Protection Officer or HR team requesting all personal data held about you under UK GDPR Article 15. Particularly useful before Tribunal proceedings.

Draft template. This letter is being reviewed by a regulated solicitor before publication. You can use it now as a starting point, but read the surrounding guide carefully and consider getting free legal advice before sending.

Particularly useful before Employment Tribunal proceedings — disclosure ranges far wider than what HR usually provides voluntarily. The 1-month deadline is hard. If the employer refuses or is incomplete, complain to the ICO (ico.org.uk/make-a-complaint). The SAR is free; you cannot be charged.

AI cross-check (2026-06-15) — pending regulated solicitor sign-off

This letter cites the following authority, which the AI has checked against current GOV.UK / legislation.gov.uk:

  • UK GDPR Article 15 (right of access / SAR): confirmed currently in force under the Data Protection Act 2018. The right to obtain a copy of all personal data processed by the controller is correctly stated.
  • Section 45 Data Protection Act 2018: this section actually governs law enforcement processing exemptions; Article 15 UK GDPR is the correct basis for a general SAR. The letter cites "Article 15 of the UK GDPR and section 45 of the Data Protection Act 2018" — reviewer should verify that s.45 DPA 2018 is the correct DPA 2018 reference for a general SAR by an employee (it may be that s.45 is cited in error; the relevant DPA 2018 provision for the right of access supplements is Part 2, Chapter 3).
  • Article 12(3) UK GDPR — 1-month response deadline: confirmed currently in force. The 1-month period runs from receipt of the SAR; extendable by 2 further months for complex/numerous requests with notice within the first month. Correctly stated.
  • Article 12(5) — SAR is free: confirmed; controllers cannot charge a fee unless requests are manifestly unfounded or excessive. Correctly stated.
  • Third-party redaction: confirmed — data controllers may redact third-party personal data where necessary to protect those individuals' rights, but this should be done proportionately.

Reviewer focus areas: (1) Verify whether "section 45 Data Protection Act 2018" is the correct statutory reference alongside Article 15 UK GDPR — section 45 DPA 2018 concerns law enforcement processing, not general data subject access. The correct supplementary provision may be under Part 2, Chapter 2 (s.22-27) of the DPA 2018 or schedule 2 exemptions. Consider updating the citation. (2) Confirm whether the DPDI Act (if enacted) modifies SAR rights for employees. (3) Confirm that the scope of disclosure in an employment context (emails, investigation notes, references) remains as described under current ICO guidance.

This AI cross-check is an aid only; final sign-off requires a regulated solicitor.

Your details

For example: "Disciplinary investigation 2024-Q1" or "All emails referring to me in the last 12 months"

Letter preview

Fill in your details on the left and press Preview letter.

Disclaimer

This information is for general guidance only and does not constitute legal advice. You should seek qualified legal help if your situation requires it.