How to respond to subject access requests from employees under the UK GDPR

Author: Jo Broadbent

Summary

Click on any of the hyperlinks to go to more detailed guidance below.

• Be aware that employees have the right under the UK GDPR to ask employers for copies of personal data relating to them.
• Implement policies and procedures for dealing with subject access requests that reflect the requirements of the UK GDPR.
• Ensure that all subject access requests are identified.
• Check the identity of the data subject if necessary.
• Take steps to clarify the scope of the subject access request.
• Consider if the request is manifestly unfounded or excessive.
• Assess where the relevant data is held.
• Carry out the searches required to assemble the relevant personal data.
• Assemble all the required information.
• Provide the data to the employee.
• Maintain records of subject access requests.