What they are actually entitled to
A copy of the personal data you hold about them, plus information about why you hold it, who you share it with and how long you keep it.
Personal data is broader than a personnel file. It includes emails that are about them, including ones where they are discussed rather than addressed. Notes of meetings. Messages on work systems. Anything where they are identifiable.
What it is not is a right to every document that mentions their department, or to your internal reasoning as a separate thing. It is their data, not your files.
Acknowledge it in writing straight away and note the date it arrived. The clock has started whether you reply or not.
The timescale, and the thing people miss
You generally have one month from receipt. Where a request is complex, or where someone has made a number of requests, that can be extended by up to a further two months, but you have to tell them within the first month that you are extending and why.
You cannot charge for it in the normal course. A fee is only possible where a request is manifestly unfounded or excessive, and that bar is high.
The thing people miss is that the deadline runs from when it arrives, not from when someone gets round to reading it. A request sitting unread in a shared inbox is still running.
Why it is usually not really about the data
In an employment dispute a DSAR is very often tactical. It is a way of seeing what you have written about someone before anything formal starts.
That is entirely legitimate, and it is why the honest advice is simple. Assume everything you write about an employee may one day be read by that employee.
If that thought makes you uncomfortable about something already in your inbox, that is worth knowing now rather than in four weeks.
Do not go through old emails deleting things. Destroying data to avoid disclosing it is a criminal offence, and it turns a manageable problem into a serious one.
What you can hold back
There are exemptions, and they matter. Information about other people can usually be redacted where disclosing it would unfairly reveal their personal data. Legal advice is generally privileged. There are limited exemptions around management forecasting and negotiations.
Redacting properly is fiddly and it is where small employers most often go wrong, either by disclosing someone else's data by accident or by over-redacting to the point where it looks like concealment.
If the request has arrived alongside a grievance or a threatened claim, get advice on the redactions rather than guessing.
The practical approach
Acknowledge it. Note the deadline in your diary and work backwards. Search properly, including email, shared drives and any HR system. Redact carefully. Send it with a short covering explanation.
And treat the whole thing calmly rather than defensively. A DSAR handled professionally often takes the heat out of a situation. One that is ignored, or answered late and grudgingly, adds a complaint to the Information Commissioner on top of whatever you were already dealing with.
“Dedicated to protecting and supporting us as employers, not just practically but on a personal level. Approachable, straightforward and knowledgeable. We'd recommend her without hesitation.”
Frequently asked questions
Do I have to hand over emails where we discussed them?
Often yes. Personal data includes emails about someone, not just emails to them. Other people's personal data within those emails can usually be redacted.
Can I refuse because they are being difficult?
Not on that basis. There is an exemption for manifestly unfounded or excessive requests, but it is a high bar and being annoyed by the request does not meet it.
What if I miss the deadline?
Deal with it as quickly as you can and be honest about the delay. The employee can complain to the Information Commissioner, and a late response in the middle of a dispute rarely improves your position.
Can I ask why they want it?
You can ask, but they do not have to tell you, and you cannot make the answer a condition of complying.
Key takeaways
- You generally have one month, extendable by two more for complex requests if you say so in time
- You cannot charge except where a request is manifestly unfounded or excessive
- The deadline runs from arrival, not from when someone opens the email
- Deleting data to avoid disclosing it is a criminal offence
- A DSAR in a dispute is usually about seeing what you wrote, so assume everything will be read
Not ready to book? Just tell me what's going on and I'll come back to you. No obligation.
