Data subject access requests
What to consider when facing race discrimination
What does an access request mean?
A person’s right to make a subject access request (sometimes referred to as a DSAR or SAR) has been a major part of data protection legislation since 1984.
A request can be made to any organisation, but is perhaps most commonly used by employees to obtain information from their employers about disciplinary, capability or redundancy situations pertaining to them, or in an ongoing employment dispute.
A subject access request should include:
- A clear label that it is a subject access request
- The date of the request
- Your name (including an aliases, if relevant)
- Any other information used by the organisation to identify you or distinguish you (eg your employee number or unique job title)
- A complete list of what personal data you want to receive
- Any details, relevant dates and search criteria that will help your employer identify what you want; and
- How you want to receive the information (eg by email or hard copy)
Responding to a subject access request can be time-consuming and expensive for employers. For employees seeking settlements, making or threatening to make a subject access request is often seen as a useful leverage tool to achieve a settlement.
You can make a subject access request to find out:
- what personal information your employer holds about you;
- how they are using it;
- who they are sharing it with; and
- where they got your data from.
This information can help you exercise your employment rights effectively.
Key elements of Data Subject Access Requests:
- If you are seeking information in the context of an employment dispute, you may want to narrow the scope of the request to the relevant time-period and, for requests for e-mails, relevant named individuals.
- In a redundancy situation, you will probably be interested in e-mails, minutes of meetings, and the attendance notes of individuals involved in the redundancy process for the period when redundancy would have been in your employer’s contemplation.
- If you require information to assist you to make your subject access request then you can ask your employer for that information. Employers have a general duty to facilitate the making of requests.
Key questions
Time to respond to a request
Your employer normally has to respond to your request within one month. If you have made a number of requests or your request is complex, they can take an additional two months to respond, providing within the first month they let you know and explain why.
Can your employer charge a fee?
Normally you should be provided your personal information free of charge. However, you can be charged a ‘reasonable’ fee to cover administrative costs if the request is considered to be ‘manifestly unfounded or excessive, or if you request additional copies. If there is an administration fee to be paid, the one-month time period will only start when payment is received.
Will you receive everything you ask for?
Not necessarily. While many employees ask for documents when making subject access requests, there is no right to see or receive actual documents – the right is to your personal data. While most employers will provide actual documents, employers that provide the data without the documents themselves are entitled to adopt that approach. Alternatively, they may provide documents, but redact information that is not your personal data. Employers can refuse to comply with a subject access request which is ‘manifestly unfounded or excessive’. Employers may refuse to provide information if it includes personal information about someone else. Some data is covered by exemptions under data protection law.
Contact us
If you feel you have a case and want the best possible advice, get in touch with our team
