Data subject access requests

New and updated

• Type:

  FAQs

  What data subject access rights do employees have under the UK GDPR?

  Updated to reflect new rules on time limits for responding to data subject access requests, in place from 5 February 2026 under the Data (Use and Access) Act 2025.

• Type:

  How to

  How to respond to subject access requests from employees under the UK GDPR

  Updated to reflect new rules on time limits for responding to data subject access requests, under the Data (Use and Access) Act 2025, in effect from 5 February 2026.

• Type:

  Employment law guide

  Data protection: data subject rights

  Updated to reflect changes to automated decision-making under the Data (Use and Access) Act 2025.

• Type:

  Legal timetable

  Changes to data protection legislation

  The Data (Use and Access) Act 2025 will make changes to data protection legislation.

• Type:

  Letters and forms

  Letter refusing subject access request or asking for administrative fee

  Updated to flag up ICO guidance on the definition of a manifestly unfounded" or "excessive subject access request.

• Type:

  Letters and forms

  Form for individual to make subject access request

  Updated to take account of verbal subject access requests, which ICO guidance states are valid.

• Type:

  Letters and forms

  Letter responding to subject access request providing requested information

  Updated to take account of verbal subject access requests, which ICO guidance states are valid.

• Type:

  Letters and forms

  Letter responding to subject access request asking for more information

  Updated to take account of verbal subject access requests, which ICO guidance states are valid.

• Type:

  Letters and forms

  Letter extending time to respond to subject access request

  Updated to take account of verbal subject access requests, which ICO guidance states are valid.

• Type:

  FAQs

  What rights of access do employees have to job references?