How do I get my records from my employer?

A subject access request is the most useful and least used employment tool there is. It reaches emails about you, notes of meetings, investigation files, performance records and much of what sits behind a decision, and the employer has to go and look. The two things that make a request succeed are being specific enough to be workable and being clear about the date range.

Step by step

1. Send it to someone who will act on it.HR, the data protection officer if there is one, or the privacy contact in the staff privacy notice. It can be made verbally or in writing and to any part of the organisation, but sending it to the right place avoids arguments about when the clock started.
2. Say what you want, specifically.'All my personal data' is valid but slow. Naming the categories — emails mentioning you between two dates, the investigation file, notes of specific meetings, the HR system record — produces a faster and more useful response.
3. Give a date range and any names.Which period, and whose mailboxes are likely to hold it. That is what makes a search proportionate, and proportionality is now expressly part of the standard the employer must meet.
4. Know the deadline.One month, counted from the date of receipt itself rather than the day after, running to the same date in the following month. Where they have to confirm your identity first, the clock starts when they have.
5. Know when the clock can pause.Where the request is genuinely unclear and clarification is reasonably required, the time limit pauses from the day the employer asks until the day they get your answer. They cannot ask for clarification as a delaying tactic and cannot force you to narrow a request.
6. Know when they can extend.A further two months for complex or numerous requests, giving three months in total from the original start date. They must tell you within the first month and explain why. Volume alone is not complexity.
7. Understand what they can withhold.Legally privileged material, information about other people where disclosure would be unfair, management forecasts and planning where disclosure would prejudice the business, negotiations with you, and confidential references. They should tell you that material has been withheld and on what basis.
8. Note the reference exemption carefully.A reference given in confidence for employment purposes is exempt from access — and the exemption applies to the organisation that gave it and to the one that received it. That closes the route many people expect to use. It blocks access, not your ability to challenge inaccurate content.
9. Complain to the employer first.Complaining to the organisation before going to the regulator is now a statutory step, not just good practice. They must have a route for it and must respond. Keep the complaint and the reply.
10. Then complain to the ICO.Raise it with the ICO within three months of your last meaningful contact with the organisation. The ICO can order compliance but cannot award you compensation — a claim for distress or loss is made against the organisation directly or in court.
11. Be realistic about timescales at the regulator.The ICO triages by harm and complaints needing detailed review can wait many months for a case officer. That is a reason to make the request early rather than as a last step before a tribunal deadline.

Tips

• Put the date range and the categories in a numbered list. It is harder to ignore and it starts a workable search.
• Send it by email and keep the sent item. When the clock started is the single most common argument.
• Ask for it in a usable electronic format. A thousand pages of printed emails is compliance of a sort, and it is not useful to you.

Common mistakes

• Making the request the week before a deadline — One month is the floor, extensions are available, and regulator involvement is slow. Ask early in any dispute, not late.
• Asking the previous employer for the reference they sent — The confidential reference exemption covers both the sender and the recipient, so neither route gets you the document. Focus on challenging inaccuracy instead.

If it doesn't work

Questions people ask