How to respond to subject access requests from employees under the UK GDPR
Author: Jo Broadbent
Click on any of the hyperlinks to go to more detailed guidance below.
- Be aware that employees have the right under the UK GDPR to ask employers for copies of personal data relating to them.
- Implement policies and procedures for dealing with subject access requests that reflect the requirements of the UK GDPR.
- Ensure that all subject access requests are identified.
- Check the identity of the data subject if necessary.
- Take steps to clarify the scope of the subject access request.
- Consider if the request is manifestly unfounded or excessive.
- Assess where the relevant data is held.
- Carry out the searches required to assemble the relevant personal data.
- Assemble all the required information.
- Provide the data to the employee.
- Maintain records of subject access requests.