Data subject access requests in employment (UK)

by Practical Law Employment with Steven Lorber, Lewis Silkin

A practice note that provides guidance for employers on handling data subject access requests (SARs) in the employment context under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), with a focus on recent amendments from the Data (Use and Access) Act 2025 (DUA Act) The note outlines the steps employers must take when responding to a SAR, from the initial assessment and clarifying scope to adhering to statutory time limits. It explores the concept of conducting a "reasonable and proportionate search" for personal data and details the practical challenges of retrieving, reviewing, and redacting information, particularly from unstructured sources like emails. Guidance is provided on handling requests that are "manifestly unfounded or excessive" and the circumstances in which a request may be refused. The note also addresses the complex issue of disclosing information that identifies another individual. It summarises key exemptions to the right of access, such as legal professional privilege, and considers the routes for challenging a response, including complaints to the Information Commissioner's Office (ICO).