Should I Raise a Data Subject Access Request Against My Employer?

something has changed at work.

Perhaps you have suddenly been placed on a performance process. Maybe an Occupational Health referral appears to contain assumptions you don’t recognise. You have raised a grievance and are concerned decisions were being discussed before you were ever interviewed. Or perhaps you simply have the uncomfortable feeling that there is information about you that you haven’t seen.

At that point, employees often start asking the same question:

Can I find out what my employer has actually recorded about me?

A Data Subject Access Request — usually called a DSAR or SAR — can sometimes help.

But there is an important distinction to make.

A DSAR gives you the right to access your personal data. It does not automatically give you the right to every document, email, investigation file or internal conversation connected with your employment.

And that is exactly why I would think carefully before simply sending an employer a broad request for “everything you hold about me”.

A DSAR can be extremely useful. But its value often depends on what you are trying to understand, when you make the request and how clearly the relevant information can be identified.

What is a DSAR?

Under UK data protection law, you have a right to obtain confirmation that an organisation is processing your personal information, a copy of that personal information and certain supplementary information about how it is being used. 

In an employment context, personal data can potentially appear in many places.

That could include emails, Teams or other workplace messages, HR records, meeting notes, investigation material, performance documentation and other records in which information relates to you.

But the right is to your personal data, rather than necessarily to the complete document containing it.

That difference matters.

When might an employee consider making a DSAR?

There isn’t one correct answer.

A DSAR may become relevant when what you are being formally told doesn’t appear to match what has happened around you.

For example, you might have concerns about how a grievance has been handled, why you have suddenly been selected for a particular process, what information contributed to a decision, or whether inaccurate information about you has circulated internally.

It can also become relevant when important conversations seem to have happened without you.

That doesn’t automatically mean wrongdoing has occurred.

But understanding what personal information exists can sometimes help you understand the wider picture.

The mistake is assuming that because a DSAR is available, submitting one immediately must always be the right next move.

Sometimes it is.

Sometimes there is something else that should be considered first.

What could a DSAR reveal?

Potentially, information you didn’t previously know existed.

An email between managers may contain personal information about you. So might an internal HR note, comments connected with a workplace process or information used when reaching a decision affecting you.

But expectations need to be realistic.

A DSAR is not a disclosure exercise in litigation, nor does it automatically entitle you to unrestricted access to an employer’s complete files.

There may also be information the employer is entitled to withhold.

For example, legal professional privilege can exempt certain personal information from the right of access. Information concerning other people also needs careful consideration and may sometimes be redacted. Other statutory exemptions and restrictions can apply depending upon the circumstances. 

So receiving a bundle containing blacked-out sections does not, by itself, establish that an employer is hiding something improper.

Equally, receiving a very limited response doesn’t necessarily mean you should simply accept that nothing else exists.

The circumstances matter.

Why has the law around DSARs been in the news again?

There has been an important recent development.

The Data (Use and Access) Act 2025 changed aspects of UK data protection law, and all its data-protection provisions were in force by June 2026. The Information Commissioner’s Office updated its subject-access guidance on 16 July 2026 to reflect those changes. 

One point now expressly reflected in the legislation is that organisations are required to carry out reasonable and proportionate searches for relevant information when responding to a SAR. 

That makes the scope of a request particularly worth thinking about.

A request covering years of employment, every system, every manager and every conceivable reference to you may sound comprehensive.

But comprehensive and effective aren’t necessarily the same thing.

Sometimes identifying the period, issue, people or categories of information that genuinely matter can make the exercise far more meaningful.

This isn’t about unnecessarily restricting your rights. The ICO is clear that an organisation cannot force somebody to narrow their request. 

It is about knowing what you are actually trying to establish.

What happens inside an employer when your DSAR arrives?

This is the part employees rarely see.

A properly recognised DSAR will usually move away from being simply an issue between you and your line manager.

Depending upon the organisation, HR, its Data Protection Officer or privacy team, IT and potentially Legal may become involved.

They need to establish what falls within the request, where relevant personal information may sit, who might hold it and what searches are reasonable and proportionate.

Potentially responsive information then needs to be reviewed.

That review matters because the organisation must consider whether the material genuinely contains your personal data, whether information concerning other people needs protecting and whether any exemption applies.

For an employer, therefore, this can become a significant information-gathering and review exercise.

And there is another practical point.

Your DSAR itself may tell the employer something.

It may signal that you are concerned about the way a workplace matter is developing and that you are starting to scrutinise the information behind decisions.

That doesn’t mean you shouldn’t make one.

It means timing deserves thought.

How long does an employer have to respond?

The normal rule is that an organisation must respond without undue delay and within one month.

There are, however, circumstances that can affect that deadline.

An organisation can extend the response period by up to a further two months where necessary if the request is complex or the individual has made a number of requests. If it does so, it must tell the requester and explain why within the initial one-month period. 

The updated rules also expressly allow an organisation to ask for clarification where it is reasonably required to identify the personal information being requested.

Where appropriate clarification is sought, the response clock can pause while the organisation waits for it and resume afterwards. 

Identity checks can also affect when the response period begins where it is reasonably necessary for the organisation to confirm who is making the request. 

So simply counting one month from the date you pressed “send” isn’t always sufficient.

Why timing can matter as much as wording

Imagine you are halfway through a grievance investigation.

Or consultation has started about your role.

Or your employer has just raised concerns about your performance.

Your immediate reaction may be:

I want everything they have about me.

Understandable.

But before doing that, I would want to understand what you are trying to achieve.

What information do you believe may exist?

What has happened immediately before this?

Is another workplace process already underway?

Are there documents you already have that point towards something specific?

And, crucially, what would you do differently if the information confirmed your concerns?

These are strategic questions rather than simply data-protection questions.

That is where independent support can make a considerable difference.

What if the response doesn’t contain what you expected?

Don’t automatically assume that means the information never existed.

But equally, don’t assume omission proves deliberate concealment.

Look at the response in context.

What searches appear to have been undertaken? What period was covered? Were particular systems, people or types of communication relevant? Have exemptions been explained where necessary? Does the information provided raise further questions?

The ICO places the burden on the organisation to be able to justify why a particular search would be unreasonable or disproportionate, while still requiring it to search for other information falling within scope. 

The important thing is to assess the response rather than simply count the number of pages.

A 500-page disclosure isn’t necessarily a useful disclosure.

Sometimes one email or one contemporaneous note is considerably more important.

Before you raise a DSAR, understand why you’re doing it

This is probably the most important point.

Don’t raise a DSAR simply because somebody on social media has told you that everyone in a workplace dispute should submit one.

Your right of access is important.

Use it intelligently.

If you’re already involved in a grievance, disciplinary, capability, redundancy or another sensitive workplace process, the DSAR may form only one part of a much bigger picture.

At TrustForce, we look at that whole picture.

We consider what has happened, what evidence already exists, how the employer is likely to approach the situation and what information may actually help you make better decisions.

Because sometimes the most important question isn’t:

“Can I submit a DSAR?”

It is:

“Is submitting one now the best move for me?”

Frequently asked questions

Can my employer refuse my DSAR?

There are limited circumstances in which information can be withheld or a request refused, including where relevant exemptions apply or a request is manifestly unfounded or excessive. A large request isn’t automatically excessive. 

Can I ask for emails and Teams messages about me?

Potentially, where they contain your personal information. But a DSAR is a right to your personal data, not automatically every complete email, message or document in which your name appears.

Does a DSAR have to be made formally?

No. The ICO confirms that a SAR can be made verbally or in writing, including through social media. From a practical perspective, however, clarity and having an appropriate record of the request can matter. 

Should I raise a DSAR before raising a grievance?

There is no universal answer. It depends on the issue, evidence already available and what you are trying to establish. This is precisely where thinking about strategy before taking action can be valuable.

Someone in your corner

If something at work doesn’t add up and you’re considering a DSAR, TrustForce can help you look at the wider situation before you decide what to do.

We understand these processes from the employer side as well as the employee side, and can help you identify the questions that really need answering.

‍ ‍