What is a Subject Access Request (SAR) in the workplace?

A SAR lets you ask your employer to confirm what personal data they hold about you and provide a copy.

In the UK, a subject access request (SAR) is a formal request under the GDPR that lets you ask organisations to confirm what personal data they hold about you and to give you a copy of that data.

In an employment context, this can cover a wide range of records such as payroll data, HR files, emails mentioning you, attendance records, and performance notes. It may also include data stored in monitoring systems or CCTV where applicable.

When you submit a SAR, be clear about the data you want and include proof of your identity so the employer can locate your records promptly. Most organisations respond within one month, and they should tell you if they need more time for a complex request.

Quick start tip: be as specific as possible about the time period and types of records you want to speed up the search and retrieval.

• Examples of data commonly requested: payroll records, contracts, attendance logs, disciplinary files, emails that mention you, pension or benefit information.
• If third parties’ data is included, your employer should redact those parts or provide a separate file containing only your data.

What counts as data held by your employer?

Data held includes most information processed about you, but protection for third‑party data and privacy rules apply.

Data held by your employer includes information you are directly associated with in the workplace: HR and payroll records, sickness and attendance data, performance reviews, training records, and correspondence where you are mentioned.

Emails or messages that refer to you, even if not saved in a personnel file, can be caught by a SAR if they contain your personal data.

Where data also involves other people, the employer should assess and, where possible, redact third‑party personal data to protect those individuals’ privacy.

• Typical data categories: personnel files, payroll data, sickness/leave records, disciplinary and grievance notes, monitoring data (where lawful).
• Redaction and separation of third‑party data are common practices to balance your rights with others’ privacy.

Deadline and timing for a SAR response

Standard 1 month, with possible 2‑month extension for complex requests; organisations must inform if more time is needed.

Under UK GDPR, the standard deadline for replying to a SAR is one calendar month from receipt of the request. In some cases, especially complex or high‑volume requests, the organisation can extend the deadline by up to two further months.

If an extension is needed, the employer must inform you within the first month, explaining the reasons for the delay and giving you a new deadline.

You have the right to complain to the Information Commissioner’s Office (ICO) if you think the delay or handling is unfair or unlawful.

• Start of the clock: receipt of a valid SAR, not when you send the request.
• Complex requests: may take up to 2 extra months; you should be told why and when to expect the data.

1. Step 1: Recognise a SAR is underway.
2. Step 2: Wait for the one‑month deadline or official extension notification.
3. Step 3: If delayed beyond the extended deadline, escalate to ICO.

Fees, exemptions and redactions

Most SARs are free; some fees or redactions apply to protect others’ rights and sensitive information.

Generally, there is no charge for a standard SAR. However, if a request is manifestly unfounded or excessive, an organisation may charge a reasonable fee or refuse the request. The ICO also notes that repeated or overlapping requests can be treated as excessive.

• No fee for a standard SAR in most cases.
• Possible charges for manifestly unfounded or excessive requests or for repeated submissions.
• Data that would harm the privacy rights of others or reveal confidential information may be redacted or withheld.

How to prepare and submit your SAR effectively

A practical, step‑by‑step guide to plan, write and submit a clear SAR to your employer.

Before writing your SAR, gather essential details: your full name, contact details, and proof of identity. Decide the scope: which data, what time period, and preferred format (electronic copies are common).

Draft a concise description of the data you want. Include approximate dates, departments, or types of records to speed up the search.

Submit your SAR to the organisation’s data controller or HR department. Keep a copy and note the date received. If you have questions, request confirmation that your request was received and track progress.

• Include identity verification documents as required.
• Provide a precise description of the data you want and the time frame.
• Ask for data in a common format (e.g., electronic copy) to speed delivery.

1. Step 1: Prepare your identity documents.
2. Step 2: Specify the data, dates, and format.
3. Step 3: Send to the data controller and obtain confirmation of receipt.
4. Step 4: Monitor progress and note any delays.