Employee data protection: what are my rights?

Your employer may track your hours, keep your sick records or score your work. You have rights over that information. Start today: email HR asking for the personal data it holds about you, save a copy and note the date. The one-month reply clock starts when your request is received.

The law, and who it protects

The UK GDPR and Data Protection Act 2018 apply across England, Wales, Scotland and Northern Ireland. The Data (Use and Access) Act 2025 amended them; its main changes to access rights and automated decisions have been in force since 5 February 2026. The EU GDPR is a separate regime that can also apply to a UK organisation in particular cross-border circumstances. There is no separate Scottish or Northern Irish GDPR.

You do not have to be an employee to use these rights. Applicants can ask for interview notes about them. Agency workers may need to ask both the agency and hirer, each for information it controls. Contractors and former staff can make requests too. A subject access request (SAR) gives you access to your personal data. It does not automatically entitle you to every document in a personnel file.

What your employer may collect and use

For each purpose, your employer needs a lawful basis under Article 6. There are now seven: consent, contract, legal obligation, vital interests, public task, legitimate interests and, since February 2026, recognised legitimate interests for narrowly specified public-interest purposes. Paying your wages may rely on contract; reporting tax to HMRC rests on legal obligation. Ordinary legitimate interests, such as securing a work network, require the employer to balance its interests against your rights. The newer recognised basis still requires necessity and compliance with the rest of data-protection law.

Signing an employment contract does not give blanket permission to process anything. Consent is not the default either. Pressure at work can make it impossible to refuse freely. A genuinely optional cycle-to-work scheme might use consent; payroll cannot depend on consent that you could withdraw tomorrow. Processing must still be fair, proportionate, secure and limited to stated purposes.

Health information, ethnicity, religion, trade-union membership and biometrics used for identification are among the special categories. They need an Article 6 basis and an Article 9 condition. When processing is necessary to meet a legal employment or social-security duty, an employer may use the employment-law condition. It must meet the relevant Schedule 1 requirements and keep an appropriate policy document. That does not automatically justify every sick note or equality questionnaire. A different purpose may need a different condition. Criminal-offence information has its own additional rules.

Your employer should tell you what data it uses, for what purpose and basis, who receives it, how long it keeps it and how to exercise your rights. Privacy information is due when the employer collects information from you. If it obtains information indirectly, it must generally explain this within a month, subject to the Article 14 exceptions and earlier triggers. Ask for the employee or applicant privacy notice if you have not seen it.

How to see your records

You can write, “Please send me the personal data you hold about me, including my interview scoring and emails discussing my application.” An email to HR is easiest to track, but a verbal request to a manager or a message on the organisation’s social account can count. You do not need a form or a reference to the UK GDPR. Keep a dated copy. You can ask for all your data. Naming a period or system may make the search faster, but the employer cannot require you to narrow the request.

1. Ask and keep evidence. Record when the organisation received the request; the usual clock begins then.
2. Answer reasonable identification questions. The employer can ask for proof if it reasonably needs to establish who you are, not demand excessive ID as a routine obstacle.
3. Check the deadline. The employer must respond without undue delay and normally by the matching calendar date next month; if that falls on a weekend or public holiday, the next working day applies.
4. Check what arrives. Expect your personal data and information about purposes, categories, recipients, retention, source and your other rights. You may receive extracts rather than whole documents if these convey the data intelligibly.

The ICO’s deadline guidance distinguishes a pause from an extension. The employer can pause the clock for clarification that is reasonably needed to identify the information. Holding a large file is not an automatic excuse. The pause starts on the day it asks and ends on the day it receives your answer. If you insist on all your information, it must still make a reasonable and proportionate search. A complex request or several requests can justify up to two additional months, with an explanation sent within the first month. Large volume alone does not automatically make a request complex.

What can be withheld?

A witness statement may contain both your data and someone else’s. The employer must consider whether disclosure of the other person’s identity is reasonable. It might redact a name, or withhold a statement if redaction would still identify a witness who was promised confidentiality. Confidential references given or received for employment may be exempt. The employer may withhold properly privileged legal advice. It may also withhold management planning, such as an unannounced redundancy proposal, where disclosure is likely to prejudice the business activity. None is a licence to black out a whole file without checking the circumstances.

The employer may refuse a manifestly unfounded or excessive request, or charge a reasonable fee for dealing with it. It may also charge for further copies. An NDA, settlement agreement, grievance or tribunal case does not cancel your access right. If an outsourced payroll provider holds records on the employer’s behalf, the employer still has to meet its SAR obligations.

How long may records be kept?

The UK GDPR says personal data must not be kept longer than necessary for its purpose. There is no universal deletion date for an ex-employee’s file. Some records have statutory minimum periods; others need a defensible retention policy. A live dispute can justify retaining relevant evidence longer, but not every unrelated message forever.

The government’s Employment Rights Act timetable says the usual employment tribunal claim window rose from three to six months on 1 October 2026. The new limit applies where the act or event complained of falls on or after that date; for most earlier acts it remains three months. Scottish breach-of-employment-contract claims are the exception, with the change taking effect on 9 November. This affects how long a business may need evidence of a recruitment or dismissal decision. It is not a statutory six-month HR deletion rule. Tribunal deadlines depend on the claim, the act complained of and any Acas early-conciliation adjustment. Keep your own records if you think you may claim; see how to bring a tribunal claim.

Can the employer monitor you?

CCTV at a warehouse entrance and a webcam taking screenshots of everyone working at home pose different privacy risks. ICO guidance requires a clear purpose, a lawful basis, fairness and the least intrusive means. Employers should explain what they monitor, why, who can see it and how long it stays on file. High-risk monitoring requires a data protection impact assessment. Routine monitoring is not automatically exempt from scrutiny. Privacy expectations are higher at home, where cameras may capture family life.

For example, a care worker can ask whether location data from visits is retained and who sees it. A warehouse picker can ask how scanner data affects a performance score. These are your work records, not a licence for endless surveillance.

Covert monitoring is exceptional. It means a targeted, time-limited investigation of suspected wrongdoing, not permanent secret observation of the whole workforce. Emails to a union representative or occupational-health clinician may contain special category data. A monitoring policy does not turn them into ordinary performance logs. If an employer cites hidden monitoring in a disciplinary meeting, request the notice, purpose and safeguards; see our workplace monitoring guide.

What about sick notes and medical reports?

Fit notes, absence reasons and occupational-health assessments reveal health information. The employer may need limited details to administer statutory sick pay or make adjustments, but that does not entitle a line manager to your full clinical history. HSE distinguishes a workplace health-surveillance health record, held by the employer, from confidential medical records held by a health professional, which the employer can access only with your written consent.

In Great Britain, the Access to Medical Reports Act 1988 gives specific rights when an employer seeks a report from a doctor who has been responsible for your clinical care. You must consent to the application and can ask to see the report before it goes to the employer. Northern Ireland has its own 1991 Order. A fresh occupational-health assessment is not necessarily the same thing as a report from your treating doctor. Ask what report the employer wants and what information it will receive.

Sharing and decisions made by software

Sharing with HMRC, a pension provider or a payroll processor may be necessary, but each disclosure needs a purpose, legal basis and appropriate safeguards. A prospective employer’s request for a reference is not a general right to your medical or disciplinary file. A police request is not, by itself, a blanket exemption. Check your privacy notice for recipients and ask why the employer shared particular data.

Since 5 February 2026, DUAA’s automated-decision rules allow some solely automated decisions with legal or similarly significant effects on a wider range of lawful bases. Safeguards still apply. These include information about the decision, a chance to make representations, human intervention and a way to contest it. Decisions using special category information face tighter conditions. An automated CV rejection is not automatically covered. The effect must meet the legal/significance test. If software alone has effectively rejected your application or ended your job, ask whether a person had meaningful involvement and how to challenge the outcome; see AI in recruitment.

Can you correct or delete data?

You can request correction of inaccurate information. Identify the entry, send the evidence and say what should replace it. You can ask for erasure when data is no longer needed or was unlawfully processed, but cannot compel deletion of records still required for tax, wage or legal-claim purposes. You can seek restriction while accuracy is disputed. You can also object to processing based on legitimate interests, recognised legitimate interests or public task; an objection to direct marketing is stronger. Data portability has narrower conditions, generally automated processing based on consent or contract. Ask the employer which basis it uses. A request does not give you a veto over every use of your data.

What if data is lost or your request is ignored?

When a breach is likely to risk people’s rights, the employer must notify the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware. It must tell affected people without undue delay where the risk is high. Not every misdirected email triggers either notification. If you receive a warning, change compromised credentials and keep the message. If you spot a breach first, report it promptly.

Tell the employer what went wrong and what remedy you want. That might be the missing SAR data, a corrected record or an explanation of a disclosure. Since 19 June 2026 it must provide a data-protection complaints process, acknowledge a complaint within 30 days, take appropriate steps and tell you its outcome without undue delay. You can also complain to the Information Commission (ICO). We recommend telling your employer first so it has a chance to put things right, but this is not a legal precondition to seeking redress. Courts can enforce data rights and award compensation for proved material loss or non-material damage such as distress. A breach or late answer does not guarantee a payout. If this also involves a workplace claim, contact Acas about early conciliation promptly (the Labour Relations Agency in Northern Ireland); the tribunal deadline is still ticking.

If your records reveal another workplace problem, use the route for that problem too. Report minimum-wage underpayment to HMRC; labour exploitation to the GLAA; unsafe work to HSE (or HSENI in Northern Ireland); discrimination to the EHRC (or the Equality Commission for Northern Ireland). Your union can help you act on records: UNISON in care and health, Unite in hospitality and transport, GMB in retail and logistics, or IWGB for many precarious and platform workers. If you are not a member, Citizens Advice or a law centre can help you find advice.

The Commission can investigate and issue penalties. The most serious UK GDPR infringements carry a statutory ceiling of £17.5 million or 4% of worldwide annual turnover, whichever is higher. That is a regulatory maximum, not compensation paid to a worker. Intentionally snooping in a colleague’s records can also engage the criminal offence in section 170 of the 2018 Act, subject to its statutory conditions and defences.

What is in force, and what is next?

1. 5 Feb 2026Data reforms in force

   Recognised legitimate interests, proportionate SAR searches, clarification pauses and revised automated-decision safeguards.

2. 19 Jun 2026Complaints duty in force

   Controllers must offer a complaints process and acknowledge complaints within 30 days.

3. 30 Sep 2026New regulator in place

   The Information Commission succeeded the Information Commissioner; “ICO” remains its public brand.

4. 1 Oct 2026Tribunal time limit in force

   Usual claim window increases to six months; Scottish employment-contract claims follow on 9 November 2026.

5. 30 Oct 2026Stronger union access scheduled

   Trade-union access reforms are scheduled to take effect; details and future dates remain subject to parliamentary processes. This is not a general licence to pass worker contact details to a union.