What specific documents can I ask for in a DSAR to my employer?

You can request a wide range of personal data, including your full HR file, disciplinary and grievance records, performance reviews, sickness absence notes, and internal emails or messages that name you. You may also request records related to redundancy, termination, or any monitoring of your activities. The request covers all personal data processed by your employer in relation to you.

How long does my employer have to respond to my DSAR?

Your employer must respond within one calendar month of receiving your request. If they request additional proof of identity, this does not extend the deadline. However, be aware that employers may use requests for excessive clarification as a tactic to delay the process, so it is important to follow up if you do not receive a timely response.

Can my employer refuse to provide certain information in my HR file?

Yes, your employer may redact personal data belonging to third parties and legally privileged communications, such as protected legal advice. However, they cannot refuse the entire request solely because some information must be withheld. If they withhold specific documents, they must identify the specific exemption relied upon for each category of information withheld.

Is a DSAR the same as a formal grievance or legal disclosure?

A DSAR is a data protection request, not a litigation disclosure request or a substitute for a formal grievance or appeal. While it can reveal useful information for employment tribunal proceedings or redundancy consultations, it may alert your employer to your intentions before you are ready. It is distinct from formal employment dispute processes.

Who should I address my DSAR to and what should I include?

You should address the letter specifically to the Data Protection Officer or the Head of HR. Sending it to a general HR inbox may delay processing. Additionally, ensure you explicitly ask for emails and internal communications, as these are considered personal data if they name you, and consider requesting information about any automated decision-making if relevant to your situation.

← All Templates

Employment

Employment Law

Updated 2026-05-16

DSAR to Employer for HR File

A Subject Access Request addressed to an employer seeking all personal data held about you, including HR records, disciplinary files, and internal communications.

This template was not drafted by a solicitor.

It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.

When to use this template

Use this letter when you want to obtain your HR file, disciplinary or grievance records, internal emails mentioning you, performance review notes, or any other personal data your employer holds. DSARs to employers are extremely useful before or during employment tribunal proceedings, a redundancy consultation, or when challenging disciplinary action. Your employer must respond within one calendar month.

When NOT to use this template

Do not use this letter as a substitute for a formal grievance or appeal. While a DSAR can reveal information useful in employment proceedings, it is not a litigation disclosure request — your employer may legitimately redact third-party personal data and legally privileged communications. Consider whether the DSAR might alert your employer to intended proceedings before you are ready.

Legal Basis

UK GDPR Article 15 (right of access); Data Protection Act 2018 s.45 where employment is in law enforcement context; ICO guidance on employment records. Third-party data may be redacted but your employer cannot refuse the entire request on this basis. Responses must be provided within one calendar month.

Before you send

Not addressing the DSAR to the Data Protection Officer or HR director specifically — a general HR inbox may delay processing
Failing to ask for emails as well as formal HR documents — internal emails are personal data if they name you
Overlooking the right to ask for information about automated decision-making if, for example, a redundancy selection was algorithm-assisted

Common Mistakes to Avoid

✗Not addressing the DSAR to the Data Protection Officer or HR director specifically — a general HR inbox may delay processing
✗Failing to ask for emails as well as formal HR documents — internal emails are personal data if they name you
✗Overlooking the right to ask for information about automated decision-making if, for example, a redundancy selection was algorithm-assisted
✗Not following up if the employer requests excessive 'clarification' — this tactic can be used to delay the one-month clock
✗Assuming all data will be disclosed — protected legal advice and third-party data can legitimately be withheld

Build Your Letter

Fill in your details

Complete the fields below. Required fields are marked with *.

Your full name*

Your home address*

Your personal email address*

Date of letter*

Employer's name*

Employer's address*

Your job title*

Your date of birth*

Employment dates*

Optional fields

Your department

Employee / payroll number

Any specific data you particularly want

Letter preview

[YOUR FULL NAME]
[YOUR HOME ADDRESS]
[YOUR PERSONAL EMAIL ADDRESS]

[DATE OF LETTER]

Data Protection Officer / Head of HR
[EMPLOYER'S NAME]
[EMPLOYER'S ADDRESS]

---

Dear Sir or Madam,

**DATA SUBJECT ACCESS REQUEST — UK GDPR Article 15**

I am writing to exercise my right of access under Article 15 of the UK General Data Protection Regulation (UK GDPR) and Section 45 of the Data Protection Act 2018. I request copies of all personal data you hold about me as a current / former employee.

**My Identity**

Full name: [YOUR FULL NAME]
Job title: [YOUR JOB TITLE]
Department: [YOUR DEPARTMENT]
Employee number / payroll number: [EMPLOYEE / PAYROLL NUMBER]
Date of birth: [YOUR DATE OF BIRTH]
Employment dates: [EMPLOYMENT DATES]

**Scope of My Request**

I request all personal data processed by [EMPLOYER'S NAME] in relation to me, including but not limited to:

1. My HR file in its entirety, including employment contract, offer letter, and variations.
2. All disciplinary records, investigation notes, hearing minutes, and outcome letters.
3. All grievance records, including any grievances raised by or about me.
4. All performance review records, appraisals, 360-degree feedback, and objective-setting documents.
5. All sickness absence records, occupational health referrals, and related correspondence.
6. All emails, instant messages, or other communications in which I am named or to which I am a party, to the extent held in a structured filing system or readily accessible form.
7. All notes or minutes of meetings involving me or concerning me.
8. Any references given about me (subject to third-party redaction).
9. Any records of monitoring of my communications, activities, or attendance.
10. Any records relating to redundancy, reorganisation, or termination.

[ANY SPECIFIC DATA YOU PARTICULARLY WANT]

**Proof of Identity**

I confirm my identity by the information above. If you require additional proof, please contact me promptly — this does not extend the one-month response deadline.

**Your Obligations**

Under Article 12(3) UK GDPR, you must respond within one calendar month of receipt. Where you withhold information under an exemption, please identify the specific exemption relied upon for each document or category withheld.

Yours faithfully,

[YOUR FULL NAME]

Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.

Related Guides

Making A Dsar

Related Rights

Official Resources

ICO — Subject Access and Employment Records →Acas — Your Employment Rights →

Frequently asked questions

What specific documents can I ask for in a DSAR to my employer?: You can request a wide range of personal data, including your full HR file, disciplinary and grievance records, performance reviews, sickness absence notes, and internal emails or messages that name you. You may also request records related to redundancy, termination, or any monitoring of your activities. The request covers all personal data processed by your employer in relation to you.
How long does my employer have to respond to my DSAR?: Your employer must respond within one calendar month of receiving your request. If they request additional proof of identity, this does not extend the deadline. However, be aware that employers may use requests for excessive clarification as a tactic to delay the process, so it is important to follow up if you do not receive a timely response.
Can my employer refuse to provide certain information in my HR file?: Yes, your employer may redact personal data belonging to third parties and legally privileged communications, such as protected legal advice. However, they cannot refuse the entire request solely because some information must be withheld. If they withhold specific documents, they must identify the specific exemption relied upon for each category of information withheld.
Is a DSAR the same as a formal grievance or legal disclosure?: A DSAR is a data protection request, not a litigation disclosure request or a substitute for a formal grievance or appeal. While it can reveal useful information for employment tribunal proceedings or redundancy consultations, it may alert your employer to your intentions before you are ready. It is distinct from formal employment dispute processes.
Who should I address my DSAR to and what should I include?: You should address the letter specifically to the Data Protection Officer or the Head of HR. Sending it to a general HR inbox may delay processing. Additionally, ensure you explicitly ask for emails and internal communications, as these are considered personal data if they name you, and consider requesting information about any automated decision-making if relevant to your situation.