A subject access request is a way of asking your employer, or any data controller, for copies of the personal information it holds about you.
The Data Protection Act 1998 allows individuals to ask organisations for the information they hold about you. In the case of your employer, this can include all your personnel records including your sickness records and absence records, and any staff reports that are held, as well as any emails in which you are mentioned.
Following the introduction of the General Data Protection Regulation in 2018, organisations are normally no longer able to charge a fee for carrying out a Subject Access Request.
Why make a Subject Access Request from your employer?
If you believe that you are being treated unfairly, or that you are being discriminated against in some way, it can be helpful to see your employment records and emails. Your records may include notes that have been written about you by your managers or other people in the organisation. Often there is a treasure trove of email information which is derogatory towards an employee. It could have details of meetings that have been about you which you were not involved in.
How to make a Subject Access Request
It’s as well to do your research before you make the request, so you know who to send your Subject Access Request to, and ensure there isn’t a fee, so you can include all this with your request. This will reduce delays.
Once you have made your Subject Access Request to your employer, your employer must respond within one month of the date they received the request.
If your employer doesn’t respond within this time, or doesn’t send all the information you think they are holding about you, you can challenge this. In some cases, though, your employer may be able to keep back some information if it also refers to someone else. In that case, your employer can only give you the information if the other person agrees, or if it would be reasonable to pass on the information without the other person agreeing.
You can make a subject access request to any organisation that controls personal data about you, not just your employer. You can get more information from the Office of the Information Commissioner.
What if your employer doesn’t comply with the Subject Access Request?
Often an employer will try to avoid complying with a Subject Access Request. If you want to push the matter, you could report your employer to the Information Commissioner’s Office (ICO). The ICO has the power to fine an employer. In addition, it is possible for someone to issue court proceedings in the County Court for a failure to adhere to the Data Protection Act 1998.