Data subject access requests


Workers have a right to access their data by making a written request known as a “data subject access request” and paying a maximum of £10. There is no need to state why you want the information. Employers must comply promptly and in any event within 40 days. There are some exceptions. For example, legally privileged documents are excluded, as are documents that reveal the employer’s plans in any situation where they are negotiating with the worker. There is no right to data processed for management planning purposes, such as strategic redundancy or reorganisation proposals affecting the workforce as a whole.


A request can be rejected if complying with it would be “onerous” or “excessive”. It is the employer's responsibility to show that a request is "disproportionate". This requires more than just asserting that searching through voluminous papers is too difficult (Dawson-Damer v Taylor Wessing [2017] EWCA Civ 74). 


Employers are not allowed to refuse a data subject access request on the ground that the person plans to use the information to bring a legal claim against them (Dawson-Damer v Taylor Wessing [2017] EWCA Civ 74).