Taking "Subject Access Requests" Seriously in the UK

October 04, 2016

Under section 7 of the Data Protection Act 1998 (DPA) employees are entitled to make a data “subject access request” (SAR) in order to obtain copies of the personal data held about them by their employer and certain other related information about how that data is stored and processed.

SARs are often lodged by employees in situations where relations between employer and employee are strained or have broken down. There may be ongoing internal disciplinary or grievance procedures or the employee may have started formal litigation. A SAR can be a valuable tool for the employee in such circumstances. Not only can a SAR potentially elicit material which is of relevance to the situation (by way for example of a “smoking gun” email) but the process of complying with the SAR can also be labour intensive and expensive for the employer. Consequently lodging a SAR may bolster the individual’s position in relation to his or her complaints, not least as part of any ongoing settlement negotiations.

If an employer fails to comply with a SAR then the employee can make a complaint to the Information Commissioner which has various enforcement powers. Alternatively, although the cost involved may be prohibitive, the employee can apply to the High Court for an order for compliance with the SAR.

Read "Taking Subject Access Requests Seriously in the UK".