Get your records from your employer: SARs explained

If you are building a grievance or a tribunal claim, get your papers first. The incident log, the emails about you, the meeting notes, the absence tracker. Ask for them now, in writing, before memories fade and files get tidied.

Your right in one minute

Any living person can ask any organisation that holds data about them for a copy. Employment status does not matter. Employee, agency temp, zero-hours, self-employed, applicant, ex-employee. Length of service does not matter. Immigration status does not matter.

For work disputes this is the paper trail: your HR file, offer letter and contract, pay and hours records, rotas, absence and lateness logs, performance notes, investigation papers, grievance and disciplinary bundles, emails and messages about you, CCTV where you are identifiable, and occupational health notes held by the employer.

Ask the organisation that controls the data. Agency staff should ask twice, once to the agency and once to the hirer, because each answers only for what it holds. A care worker on agency shifts might get pay and assignment texts from the agency and rota sheets and conduct notes from the home. Ask both.

What to ask for

Be specific enough to help them find it, but you do not have to narrow a broad request if you want everything. Name the date range and the systems if you can. For a dispute about a final written warning in September, ask for everything from June to October plus the warning bundle.

CCTV needs speed. Many systems overwrite in days or weeks. Put the camera, site and time window in the request on day one.

How to ask today

You do not need a form and you do not need the words subject access request, though using them helps. Verbal requests and messages on social media count. Email wins in practice because you can prove it.

1. Send it to the right inbox. HR, the data protection contact, or your manager if no contact is published. If you send it to a manager, say plainly it is a data access request and ask them to forward it.
2. Say who you are and what you want. Full name, how to identify you on their systems, the records and date range, and where to send the reply. Keep a copy and proof of sending.
3. Use the ICO tool. The ICO Make a subject access request service builds the email for you and tells you what ID to attach. Use its wording rather than a blog template. The ICO notes the page is under review for 2025 Act changes, so follow its current controller guide too.
4. Do not pay unless they justify it. Access is free in most cases. A reasonable fee is allowed only if your request is manifestly unfounded or excessive, or you ask for extra copies. See the ICO guide to subject access.
5. Reply fast to ID or clarification. If they reasonably ask for ID or for detail to locate a large file, the clock does not run while they wait for you. Send it straight away.

Deadlines, with the maths

The employer must reply without undue delay and at the latest within one calendar month of receipt. If that date falls on a weekend or a public holiday, ICO guidance moves the deadline to the next working day. That is the applicable time period in UK GDPR Article 12A, inserted by section 76 of the Data (Use and Access) Act 2025, in force from 5 February 2026.

The clock starts on the latest of three dates: receipt of the request, receipt of ID or authority evidence they reasonably asked for, or payment of any fee. ICO guidance says they should ask for ID promptly. Supply it promptly is the rule for you.

Two traps catch workers. First, a broad request does not let the employer stall. It can ask what you mean if it holds a lot of data on you, and the wait for your answer pauses the clock, but if you repeat the broad request it must run a reasonable search. Second, a subject access request pauses nothing else. Grievance talks, Acas early conciliation and tribunal time limits run on a separate clock. Since 1 October 2026 most employment tribunal claims have a six-month limit for acts on or after that date, but do not rely on memory. Check the time limit guide and start conciliation in parallel.

What they can withhold

Exemptions are decided case by case, with reasons recorded and explained to you. The common ones in work cases, under Data Protection Act 2018 Schedule 2:

Other people’s data. Your file will mention colleagues, witnesses and complainants. The employer must not disclose information that identifies another person unless that person consents or it is reasonable to disclose without consent. Expect redactions of witness names in grievance interviews. The substance about you should still come through.

Legal advice. Communications with their solicitor for advice or litigation carry legal professional privilege. A manager asking HR how to handle a shift row is not privilege. A letter from the company solicitor about tribunal tactics usually is.

Management plans and negotiations. Succession lists, promotion rankings and redundancy selection planning can be withheld to the extent disclosure would be likely to prejudice the business. Settlement talks with you can be withheld to the extent disclosure would be likely to prejudice the negotiations. These are narrow. They do not cover the whole disciplinary file.

Confidential references. A reference given in confidence for a job, training or education is exempt from the right of access (Data Protection Act 2018, Schedule 2, paragraph 24), whether you ask the employer who wrote it or the one who received it. Either can still choose to share it, so asking costs nothing.

Search limits are also new law. Under section 78 of the Data (Use and Access) Act 2025, in force at Royal Assent on 19 June 2025 and treated as effective from 1 January 2024, the employer need only run a reasonable and proportionate search. A small shop does not have to hire forensic IT to trawl dead backups. A large trust with a proper archive cannot claim a keyword search of live mailboxes is too much trouble. Being busy is not an exemption.

What the 2025 Act changed

The Data (Use and Access) Act 2025 rewrote parts of access law. The Employment Rights Act 2025 changed nothing about subject access. Keep the two Acts apart.

1. 19 Jun 2025Reasonable search limit live

   Section 78: only a reasonable and proportionate search is required. Backdated to 1 January 2024.

2. 5 Feb 2026New clock rules live

   Section 76 and Article 12A: the clock starts on the latest of the request, any ID they asked for, and any fee. Extension only for complex or numerous requests, with reasons in month one. The clock pauses from the day they ask for clarification through the day you reply.

3. 19 Jun 2026Complaints duty live

   Section 164A of the 2018 Act: employers must make complaints easy, acknowledge within 30 days, investigate without undue delay and report the outcome. See ICO confirmation.

4. 16 Jul 2026ICO controller guide updated

   Follow the July 2026 ICO guide and June 2026 complaints guidance, not old blog summaries. See the GOV.UK explainer.

If they ignore you or send almost nothing

Work this ladder fast, because your underlying claim deadline does not wait.

1. Chase in writing before the deadline. Resend the request, attach proof of the first send, and set out what is missing. Ask for the name of the data contact and a reply date.
2. Complain to the employer. Since 19 June 2026 this is a formal first stage under section 164A. Use any electronic complaint form they provide. They must acknowledge within 30 days of receipt, look into it without undue delay, keep you updated and tell you the outcome.
3. Complain to the ICO. Use the ICO online complaint service once the employer stage is done. The ICO asks you to complain within three months of your last meaningful contact with the employer. The ICO can investigate and take enforcement action.
4. Ask a court to order compliance. You do not have to go through the ICO first. Under section 167 the county court in England, Wales and Northern Ireland, or the sheriff court in Scotland, can order the employer to comply. Compensation is available under section 168. Get free advice before issuing: union legal service, law centre or Citizens Advice.

Scotland and Northern Ireland differ only on doors, not rights. Time limits, fees, exemptions and the complaints duty are UK wide and the ICO covers the whole UK. Only the court route and the conciliation body change: county court and Acas in England and Wales, sheriff court and Acas in Scotland, county court and the Labour Relations Agency in Northern Ireland.