Subject Access Request to a Former Employer (UK): What They Must Provide

When employment ends, particularly in difficult circumstances, the employer keeps the records of what managers wrote about you, what HR recorded and the emails in which decisions about you were discussed.

A subject access request under Article 15 of the UK GDPR requires your former employer to provide the personal data it holds about you. The request is free in almost all cases and does not require a solicitor, a particular form or a reason, and the employer must normally respond within one month.

This guide explains what you can obtain, what the employer may lawfully withhold, and how to make the request.

The right continues after employment ends

The right of access belongs to you as an individual and does not depend on being a current employee. A former employer usually holds personal data about you for some years after you leave, including payroll and pension records, the HR file, appraisals and emails to and about you. You can request that data for as long as the employer holds it.

You do not need to give a reason for the request, and having one does not weaken it. The courts have confirmed that making a subject access request to obtain information for litigation is permissible, so your former employer must respond even where it knows the request is connected to a tribunal claim.

Once a request has been made, it is a criminal offence under section 173 of the Data Protection Act 2018 to alter, deface, block, erase, destroy or conceal information with the intention of preventing its disclosure. If you are concerned that information may be deleted, you can refer to section 173 in your request.

What you can ask for

Personal data is information relating to you as an identifiable individual. In an employment context, that includes:

• Your HR file, such as your contract, appraisals, performance reviews, warnings, grievance and disciplinary records, sickness records and occupational health reports.
• Emails and messages about you, such as correspondence between your manager and HR about your performance, a grievance or your dismissal, and messages on workplace systems such as Teams or Slack that refer to you. You can ask the employer to search specific mailboxes.
• Notes and minutes, such as interview notes from a disciplinary investigation, notes of meetings about you and internal case summaries.
• System and monitoring records, such as monitoring data, building access and system logs, and any automated scoring or flagging relating to you.

Documents that mention you only in passing, where the information is not really about you, are not personal data for this purpose, because the test is whether the information relates to you.

What may be withheld

The exemptions most often relevant in employment cases are set out below, and knowing them will help you assess whether a refusal or a partial response is justified.

Confidential references. A reference given or received in confidence is exempt, so a subject access request will not usually obtain a reference your former employer provided to a new employer.

Legal advice. Material covered by legal professional privilege, such as advice the employer received from its solicitors about your case, is exempt. Internal HR emails about you do not become privileged simply because a solicitor was later involved.

Other people's data. Where your data is mixed with someone else's, such as a witness statement in a grievance investigation, the employer must balance your right of access against the other person's rights. In practice this usually leads to redaction rather than refusal, and the ICO expects employers to disclose as much as they can without identifying the other person.

Negotiations with you. A record of the employer's intentions in negotiations with you, such as the terms it was prepared to agree, is exempt to the extent that disclosure would prejudice those negotiations. This usually applies while negotiations are ongoing, although the ICO accepts that it may continue to apply afterwards where the prejudice continues.

Management forecasting and planning. Material used for management forecasting or planning, such as a restructuring or redundancy plan, may be withheld where disclosure would prejudice that activity. The exemption does not extend to ordinary emails about you that do not form part of the forecasting or planning exercise.

Each exemption applies document by document, and the employer should tell you that an exemption has been applied. If a response appears incomplete, you can ask the employer to confirm whether any material has been withheld under an exemption and, if so, which.

How to make the request

A request can be made by email, to HR or to any address the employer uses, and it is valid however it is received. A short request such as the following is sufficient:

I am making a subject access request under Article 15 of the UK GDPR. Please provide copies of the personal data you hold about me, including my HR file and the emails and messages that refer to me between [date] and [date], including searches of the mailboxes of [names of the managers involved]. Please confirm receipt. I look forward to your response within one month.

When preparing and sending the request:

1. Specify the people and the period. Because the employer is required to carry out a reasonable and proportionate search, a focused request, for example the mailboxes of the people who handled your dismissal over a defined period, is more likely to produce a complete and timely response than a request for everything since you joined.
2. Keep evidence of the date you sent it. The one-month period runs from the date the employer receives the request, so note the deadline.
3. Expect an identity check. The employer may verify your identity before responding, which can pause the response briefly but is otherwise routine.

If the deadline passes without a response, or the response is clearly incomplete, you can complain to the ICO, which is free and done online.

How a subject access request differs from tribunal disclosure

Disclosure in tribunal proceedings takes place later, is ordered by the tribunal, and covers documents relevant to the issues in the claim whether or not they are your personal data. A subject access request can be made earlier, covers your personal data more broadly but other documents not at all, and is entirely within your control. People bringing claims often use both, making a subject access request first to establish what exists and then seeking disclosure in the proceedings.

The law in this area continues to develop, through court decisions on the exemptions, updates to ICO guidance and changes to employment law. Leave your email in the box below to receive a short note when something on this page changes.