Subject Access Request to a Former Employer (UK): What They Must Hand Over

Leaving a job, especially one that ended badly, has an information problem. The employer keeps the file. What your manager wrote about you, what HR recorded, what was said in the emails that decided your future: it all exists, and the employer holds every page of it.

UK law gives you a tool that moves it across the table. A subject access request, made under Article 15 of UK GDPR, obliges your former employer to hand over the personal data they hold about you. It costs nothing, it needs no lawyer, no form and no justification, and the employer has one month.

This guide covers what you can get, what they can lawfully hold back, and how to write the request so it is hard to ignore or mishandle.

The right survives the job

Your right of access belongs to you as a person, and it has nothing to do with being a current employee. A former employer holds your personal data for years after you leave: payroll and pension records, the HR file, appraisals, emails to and about you. While they hold it, you can request it.

Two things people in disputes assume wrongly, both in the employer's favour.

First, motive. You do not need a reason, and having an obvious one does not weaken the request. The courts have confirmed that making a SAR to arm yourself for litigation is fine. Your former employer must answer the request even when they know it is the opening move in a tribunal claim.

Second, deletion. Once you have made the request, altering, concealing or destroying the data to prevent you seeing it is a criminal offence under section 173 of the Data Protection Act 2018. The nervous manager who wants embarrassing emails to disappear commits an offence by making that happen. If you are worried about deletion, cite section 173 in your request.

What you can ask for

Personal data means information relating to you as an identifiable person. In an employment file, that reaches further than most people expect:

• Your HR file: contract, appraisals, performance reviews, warnings, grievance and disciplinary records, sickness records, occupational health reports.
• Emails and messages about you. This is usually the valuable part. Emails between your manager and HR discussing your performance, your dismissal, your grievance. Messages on work systems (Teams, Slack) that talk about you. The employer can search them, and you can ask for that search to be run.
• Notes and minutes: interview notes from a disciplinary investigation, notes of meetings about you, internal case summaries.
• Automated things: monitoring data, door-entry and system-access logs, anything an algorithm scored or flagged about you.

You will not get documents that merely mention you in passing where the information is not really about you, and you will not get the whole company's records. The test is whether the information relates to you.

What they can withhold

Knowing the exemptions stops you being fobbed off with vague refusals. The ones that actually arise in employment cases:

Confidential references. A reference given or received in confidence is exempt. If you want to know what your old boss told a new employer, the SAR route usually will not get it from either company.

Legal advice. Anything covered by legal professional privilege, the advice the company took from its solicitors about your case, is exempt. Their internal HR emails about you are generally not privileged just because a lawyer was eventually involved.

Other people's data. Where your data is mixed with someone else's, a witness statement in a grievance investigation, for example, the employer must balance your right against theirs. In practice this means redaction more often than refusal, and the ICO expects them to disclose what they can without identifying the other person.

Negotiations with you. A record of the employer's intentions in negotiations with you (what they were actually prepared to settle for) is exempt to the extent that disclosing it would prejudice those negotiations. Usually that means while they are live, though the ICO accepts the exemption can stretch past the end where the prejudice continues.

Management planning. Documents about restructuring or business forecasting can be withheld where disclosure would prejudice the planning. This can cover the redundancy-planning spreadsheet, and even planning material naming you; it does not cover ordinary emails about you that are not themselves part of the forecasting or planning exercise.

Every one of these applies document by document, and the employer should tell you an exemption has been applied rather than pretending the material does not exist. A response that looks thin deserves the follow-up question: "please confirm whether material has been withheld under an exemption, and which".

How to write it

Email works. Send it to HR, or to any address the company actually uses; a SAR is valid however it arrives. Keep it short:

I am making a subject access request under Article 15 UK GDPR. Please provide copies of the personal data you hold about me, including my HR file, and emails and messages that refer to me between [date] and [date], including searches of the mailboxes of [names of the managers involved]. Please confirm receipt. I look forward to your response within one month.

Three practical points:

1. Name the people and the period. The law expects a reasonable and proportionate search, so a focused request (the mailboxes of the three people who handled your dismissal, over eighteen months) gets you more, faster, and is harder to call excessive than "everything since I joined".
2. Keep proof of the date you sent it. The month runs from receipt. Diary the deadline.
3. Expect an identity check. They can verify who you are; that pauses things briefly, and is otherwise routine.

If the deadline passes with silence, or the response is obviously incomplete, the route is a complaint to the ICO, free, online, and taken seriously, particularly where the employer ignored a documented deadline. In parallel, an ignored SAR tends to look poor for an employer in front of a tribunal.

How a SAR differs from tribunal disclosure

A SAR is not the same as disclosure in tribunal proceedings. Tribunal disclosure comes later, is ordered by the tribunal, and covers documents relevant to the issues whether or not they are your personal data. The SAR is earlier, broader on personal data and narrower on everything else, and entirely in your control. People with strong cases often use both: the SAR first, to see what exists, then disclosure to compel the rest.

The law on all of this moves: exemptions get tested in court, the ICO updates its guidance, and employment-rights reform keeps changing the rules around dismissal claims. Leave your email in the box below and you will get one short note when something on this page changes.