Does an individual who is no longer employed by the employer have data access rights, and if so for how long after leaving?

Yes, an ex-employee has data access rights for as long as the employer holds information about him or her. The employer is the data controller under the General Data Protection Regulation (2016/679 EU) and the ex-employee is the data subject; the ex-employee is therefore entitled to make a data subject access request in respect of the personal data the employer holds on him or her.

One of the data protection principles is that personal data shall not be kept for longer than is necessary for the purpose for which it is held. This means that the employer must delete the data once it is no longer needed and the employee can no longer gain access to it.

There are a number of statutory requirements for the retention of records, for example in relation to income tax or certain aspects of health and safety. Employers must comply with these requirements but should delete other personal information that is no longer needed once the employment relationship has ended. Employers should set standard retention times for different categories of information.