DSAR to Employer for HR File
A Subject Access Request addressed to an employer seeking all personal data held about you, including HR records, disciplinary files, and internal communications.
This template was not drafted by a solicitor.
It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.
When to use this template
Use this letter when you want to obtain your HR file, disciplinary or grievance records, internal emails mentioning you, performance review notes, or any other personal data your employer holds. DSARs to employers are extremely useful before or during employment tribunal proceedings, a redundancy consultation, or when challenging disciplinary action. Your employer must respond within one calendar month.
When NOT to use this template
Do not use this letter as a substitute for a formal grievance or appeal. While a DSAR can reveal information useful in employment proceedings, it is not a litigation disclosure request — your employer may legitimately redact third-party personal data and legally privileged communications. Consider whether the DSAR might alert your employer to intended proceedings before you are ready.
Legal Basis
UK GDPR Article 15 (right of access); Data Protection Act 2018 s.45 where employment is in law enforcement context; ICO guidance on employment records. Third-party data may be redacted but your employer cannot refuse the entire request on this basis. Responses must be provided within one calendar month.
Before you send
- Not addressing the DSAR to the Data Protection Officer or HR director specifically — a general HR inbox may delay processing
- Failing to ask for emails as well as formal HR documents — internal emails are personal data if they name you
- Overlooking the right to ask for information about automated decision-making if, for example, a redundancy selection was algorithm-assisted
Common Mistakes to Avoid
- ✗Not addressing the DSAR to the Data Protection Officer or HR director specifically — a general HR inbox may delay processing
- ✗Failing to ask for emails as well as formal HR documents — internal emails are personal data if they name you
- ✗Overlooking the right to ask for information about automated decision-making if, for example, a redundancy selection was algorithm-assisted
- ✗Not following up if the employer requests excessive 'clarification' — this tactic can be used to delay the one-month clock
- ✗Assuming all data will be disclosed — protected legal advice and third-party data can legitimately be withheld
Build Your Letter
Fill in your details
Complete the fields below. Required fields are marked with *.
Optional fields
Letter preview
[YOUR FULL NAME] [YOUR HOME ADDRESS] [YOUR PERSONAL EMAIL ADDRESS] [DATE OF LETTER] Data Protection Officer / Head of HR [EMPLOYER'S NAME] [EMPLOYER'S ADDRESS] --- Dear Sir or Madam, **DATA SUBJECT ACCESS REQUEST — UK GDPR Article 15** I am writing to exercise my right of access under Article 15 of the UK General Data Protection Regulation (UK GDPR) and Section 45 of the Data Protection Act 2018. I request copies of all personal data you hold about me as a current / former employee. **My Identity** Full name: [YOUR FULL NAME] Job title: [YOUR JOB TITLE] Department: [YOUR DEPARTMENT] Employee number / payroll number: [EMPLOYEE / PAYROLL NUMBER] Date of birth: [YOUR DATE OF BIRTH] Employment dates: [EMPLOYMENT DATES] **Scope of My Request** I request all personal data processed by [EMPLOYER'S NAME] in relation to me, including but not limited to: 1. My HR file in its entirety, including employment contract, offer letter, and variations. 2. All disciplinary records, investigation notes, hearing minutes, and outcome letters. 3. All grievance records, including any grievances raised by or about me. 4. All performance review records, appraisals, 360-degree feedback, and objective-setting documents. 5. All sickness absence records, occupational health referrals, and related correspondence. 6. All emails, instant messages, or other communications in which I am named or to which I am a party, to the extent held in a structured filing system or readily accessible form. 7. All notes or minutes of meetings involving me or concerning me. 8. Any references given about me (subject to third-party redaction). 9. Any records of monitoring of my communications, activities, or attendance. 10. Any records relating to redundancy, reorganisation, or termination. [ANY SPECIFIC DATA YOU PARTICULARLY WANT] **Proof of Identity** I confirm my identity by the information above. If you require additional proof, please contact me promptly — this does not extend the one-month response deadline. **Your Obligations** Under Article 12(3) UK GDPR, you must respond within one calendar month of receipt. Where you withhold information under an exemption, please identify the specific exemption relied upon for each document or category withheld. Yours faithfully, [YOUR FULL NAME]
Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.