Short answer: You must respond to a subject access request within one month of receiving it, or of receiving any ID you reasonably ask for. You can extend by up to two months if the request is complex or one of several, and you can pause the clock to ask for clarification. You only need to carry out a reasonable and proportionate search.
Employees often make a subject access request, usually called a DSAR, when something has gone wrong: a grievance, a disciplinary, a resignation or the threat of a claim. The request can look like a fishing exercise, but it is a legal right, and mishandling it creates a separate risk of an ICO complaint and an adverse picture in any later tribunal.
The Information Commissioner’s Office guidance says you must respond without undue delay and within one month of receiving the request. The month runs from receipt of the request, or from receipt of any ID information, evidence of a third party’s authority or a fee, where you have properly asked for one.
You can extend by up to a further two months if the request is complex or you have received several requests from the same person. You must tell the individual within the first month and explain why.
You can also stop the clock. If you reasonably need clarification, the period pauses on the day you ask and starts again the day after you receive the answer. Ask for clarification only where you genuinely need it, and ask promptly.
1. Log it the day it arrives. A DSAR does not need to use a particular form of words, and it can be made to anyone in the business, including a line manager by email or message. Train managers to forward anything that looks like one straight to HR.
2. Confirm identity if there is real doubt. For a current employee you know, this is rarely needed. For a former employee or a request sent via a solicitor, check authority.
3. Clarify if the request is very wide. “All my data” is common. You may ask them to narrow it, for example by date range, topic or the people involved, and the clock pauses while you wait. You must still deal with the request if they decline to narrow it.
4. Search sensibly. The law requires a reasonable and proportionate search, not an unlimited one. For an employee, that normally covers the HR file, payroll, absence records, performance and disciplinary records, email and messaging platforms where they are named or are the subject, and notes held by their managers. Keep a record of where you searched and why.
5. Review what you find. The employee is entitled to their personal data, not necessarily to whole documents. Where a document mixes their data with other people’s, you may redact.
6. Apply exemptions with a reason. The exemptions most likely to matter in employment are:
- Information about other people. Do not disclose it unless the person consents or it is reasonable to disclose without consent. Redact names or details where needed.
- Legal professional privilege. Advice from your solicitor on the dispute is not disclosable.
- Management information. Confidential planning, such as who may be made redundant, can be withheld where disclosure would prejudice the business.
- Confidential references. References given in confidence can be withheld.
- Missing the deadline because the request sat in a manager’s inbox.
- Searching only HR records and ignoring emails and chat messages that mention the employee.
- Disclosing other people’s personal data by failing to redact.
- Using a vague blanket refusal such as “this is too burdensome”.
- Deleting data after a request arrives. Deleting to avoid disclosure is a serious problem.
- Failing to record what was searched, withheld and why.
Document why each exemption was applied. You must be able to justify it.
7. Respond in a usable form. Send the data securely, with the information the law requires, such as the purposes of processing, the recipients and the retention period.
Facing a DSAR that looks like the start of a claim? We manage employee DSARs end to end, including searches, redaction and the covering response. [Get DSAR support]
You can refuse or charge a reasonable fee for a request that is manifestly unfounded or excessive, or both. The ICO says this is a high threshold, and employers who rely on it without good grounds usually regret it. The fact that an employee is using a DSAR to gather material for a grievance or claim does not, on its own, make the request invalid. Context matters, and each case needs a careful look.
In most cases you cannot charge a fee. You can charge a reasonable fee for administrative costs where the request is manifestly unfounded or excessive, or where the individual asks for further copies.
How long do I have to respond to a DSAR? One month from receipt of the request, or from receipt of any ID or authority you reasonably requested. You can extend by up to two further months for complex requests or several requests from the same person, and you can pause the clock to seek clarification.
Can I refuse a DSAR from an employee in a dispute? Only if it is manifestly unfounded or excessive, which is a high threshold. A request made to help a grievance or claim is not automatically unfounded. If you refuse, explain why and tell them about their right to complain to the ICO.
Can I charge for a DSAR? Normally no. You can charge a reasonable fee for administrative costs if the request is manifestly unfounded or excessive, or if the person asks for further copies.
Do I have to search every email? No. You must carry out a reasonable and proportionate search, considering the importance of the information and the effort involved. Keep a record of your search so you can show it was reasonable.
What can I withhold from a DSAR? Information about other people unless it is reasonable to disclose it, legally privileged material, confidential management planning information and confidential references, among other exemptions. Apply them case by case and record your reasons.
Our data protection and employee relations advisers handle DSARs for employers on a fixed fee, including when they arrive alongside a grievance or claim.
Reviewed 8 October 2026. This article is general guidance and not legal advice.
.webp?width=300&name=windows-2EwyKv4-03k-unsplash%20(2).webp)
