If an employee asks for a copy of his or her "personnel file" is the employer obliged to supply all the information held on the employee?

Under the Data Protection Act 1998, an individual is entitled to submit a written request for access to any personal data, ie any information about him or her held in a structured manual file or on computer. The employer, which may charge a fee of up to £10 for this, must comply with such a request by providing the individual with copies of the personal data within 40 calendar days.

There are some exceptions to an individual's right of access to personal data. One exception to the employer's duty to disclose personal data is where the information requested is for the purpose of management forecasting or management planning, and where disclosure could prejudice the employer's interests. The other main exception is where disclosure of the information would reveal personal information about a third party who can be identified from the information. In this case, the employer may not automatically refuse to disclose the information. Instead, it should seek either to edit the relevant documents in order to conceal the identity of the third party or, if this is not possible, to seek his or her consent to the disclosure of the information. The employer should also disclose the data if it would be reasonable in all the circumstances to do so without the consent of the third party. What is reasonable will depend on the duty of confidentiality owed to the third party, any steps that the employer has taken to seek his or her consent and whether the third party is capable of giving consent or has expressly refused consent. These principles would apply to any reference held on an employee's personnel file that had been supplied by a previous employer.