These Subject Access Request templates help employers manage employee data access requests under the UK GDPR and the Data Protection Act 2018. A subject access request, often shortened to SAR or DSAR, allows an individual to ask an organisation whether it processes their personal data and to obtain access to that data.
The documents are designed to help employers respond consistently, gather the information needed to locate personal data, confirm identity where necessary, and manage response times for standard, unclear or complex requests.
Additional templates to help employers comply with data protection laws are available at Employment Data Protection Policies and Employment Privacy Notices.
What is a Subject Access Request?
A Subject Access Request is a request by an individual to access personal data held about them by an organisation. In an employment context, SARs may be made by employees, former employees, workers, contractors, job applicants or other individuals whose personal data is held by the business.
A SAR may ask what personal data is held, why it is being processed, where it came from, who it has been shared with, how long it will be retained, whether automated decision-making or profiling is used, and what rights the individual has in relation to that data. SARs are an important part of employee data protection compliance and should be handled carefully, particularly where HR records, emails, disciplinary documents, grievance records, sickness records, payroll data or personnel files are involved.
Downloadable SAR Templates
These practical templates enable employers to handle employees subject access requests from start to finish.
Employee’s Subject Access Request Form
The Employee’s Subject Access Request Form provides a structured form for employees or other data subjects to request access to personal data held about them by the company.
The form asks the requester to provide their name, contact details and specific information about the personal data they are requesting, including relevant dates or details that may help the employer locate the data. It also includes a declaration confirming that the individual is the data subject named in the form and that the request is being made under the UK GDPR.
Employees' Subject Access Request Policy
This Subject Access Request Policy gives employers a concise internal policy explaining how employee SARs will be handled.
The policy explains that individuals have the right to receive confirmation that the company processes their data and to access that data. It defines personal data and special category personal data, explains what a SAR may cover, and sets out how employees should make a request. It also confirms that SARs may be made verbally or in writing, although the employer may encourage written requests or use of a SAR form for efficiency.
The policy also covers response times, ID checks, fees, complex requests, excessive or repetitive requests, refusal grounds and complaints to the Information Commissioner’s Office.
Letter Acknowledging Subject Access Request
The SAR Acknowledgement Letter is a standard acknowledgement letter for use where an employer has received a SAR and can proceed with the request without needing further information or an extension at the outset.
The letter confirms receipt of the request, records the date it was received, optionally acknowledges identity evidence such as a passport or driving licence, and confirms that the company will respond as soon as possible and no later than one month from receipt.
This is the most straightforward acknowledgement template and is suitable for routine SARs where the request is clear and identity has been confirmed.
Request Fee Subject Access Request Acknowledgement Letter
This SAR Acknowledgement Letter, asking for administrative fee and time to respond, is intended for complex, high-volume or time-consuming requests where an extension may be required and, where permitted, an administrative fee may be requested.
The template includes wording for situations where the request is complex and involves extensive review of emails or other documents, or where data is held in several locations. It allows the employer to state that the request is complex and that the timescale for response will be extended. It also includes optional wording for requesting an administrative fee where the company is prepared to comply with the request subject to payment of a fee reflecting the administrative cost.
This template should be used carefully, as SARs are generally free of charge and fees are only appropriate in limited circumstances, such as where requests are manifestly unfounded, excessive or repetitive, or where further copies are requested.
More Information Subject Access Request Acknowledgement Letter
This SAR Acknowledgement Letter, is designed for situations where the employer cannot respond properly until the requester provides additional details or confirms their identity.
The template allows the employer to ask for specific information needed to locate the requested personal data, such as approximate email dates, sender or recipient details, or other search information. It can also be used to request proof of identity, such as a certified copy of a driving licence or passport.
The time limit for responding to a subject access request is one month from the date of receipt. If a request is complex, the time period for response can be extended by a further two months.
Please click on the links below to view and download the templates:
Employee Subject Access Request Templates is part of Employment. Just £38.50 + VAT provides unlimited downloads from Employment for 1 year.
Frequently Asked Questions
One of my employees has asked to see all the personal data I hold about them. Do I have to respond, and how long do I have? +
Yes, but the right is not absolute. An employee's right to access their personal data is a legal obligation under the UK GDPR and the Data Protection Act 2018, and you must respond without undue delay and no later than one calendar month from receiving the request. If the request is complex or you have received several requests from the same person, you may extend by up to two further months, but you must notify the employee within the original one-month period and explain why. You can refuse to provide all or some of the information where an exemption or restriction under the UK GDPR or DPA 2018 applies (for example confidential references, legal professional privilege, third-party data or management forecasts) or where the request is manifestly unfounded or excessive, decided on a case-by-case basis and documented. To confirm receipt and record the deadline, use the Simply-Docs SAR Acknowledgement Letter, or the More Information SAR Acknowledgement Letter where you need further details before the clock runs.
An employee has submitted a subject access request during a disciplinary or grievance process. Can I delay or refuse it? +
Generally, no. A live disciplinary or grievance process does not by itself suspend or pause the one-month response deadline. The ICO is explicit that you cannot refuse a SAR simply because the employee appears to be using it tactically or in connection with potential litigation. Two carve-outs apply, however. First, you can extend the one-month deadline by up to two further months if the request is genuinely complex or the worker has sent a number of requests, and you can pause the clock while you seek clarification, provided you tell the worker within one month and explain your reasons. Second, against a high threshold and on a case-by-case basis, you may still refuse a request that is 'manifestly unfounded' (for example offered to be withdrawn in return for a benefit, or malicious) or 'manifestly excessive', and the litigation purpose can be weighed as one factor in that assessment. Otherwise process the request in the normal way, applying any relevant exemptions (such as third-party personal data or legal professional privilege) on a case-by-case basis and documenting your reasons. A structured internal policy, such as the Employees' Subject Access Request Policy from Simply-Docs, helps ensure a consistent and defensible process in these higher-risk situations.
Does a subject access request have to be made in writing, and does the employee have to use a specific form? +
No. Under the UK GDPR there are no formal requirements for how a SAR is made. An employee can submit a request verbally, by email, by letter or even via social media, and need not use the words 'subject access request' or mention the UK GDPR. Any clear request for personal data you hold about them counts. You can encourage use of a structured form for efficiency but cannot insist on it as a condition of responding. Simply-Docs provides an Employee's Subject Access Request Form to set out requests clearly and declare identity, reducing delays from incomplete requests.
Can I charge a fee before responding to an employee's subject access request? +
No: as the default position under UK GDPR Article 12(5), responding to a SAR must be free of charge. A reasonable administrative fee may only be charged where a request is manifestly unfounded or excessive, or where the individual asks for further copies of data already provided. Volume and inconvenience alone do not meet the threshold. If you do charge, notify the employee before beginning work and do not use the fee to extend your response time. Use the Request Fee SAR Acknowledgement Letter from Simply-Docs with care and only in genuinely qualifying circumstances.
My employee's request is very broad or unclear. Can I ask them for more information before I start, and does that pause the deadline? +
Usually yes, but not for law-enforcement data: where the scope is genuinely unclear, or you hold a large volume of data and need the employee to narrow their search, you may ask for clarification. Under the Data (Use and Access) Act 2025 the one-month response period is paused while you await it, provided the clarification is reasonably necessary to locate the data. That pause applies only to clarification about the information requested, not to other matters such as the format. It also does not apply to any data processed for law-enforcement purposes under Part 3 of the DPA 2018: there the time limit is not paused and you must still respond within one month, so ask for any clarification as soon as possible. Ask promptly and only where genuinely needed. Simply-Docs provides a More Information SAR Acknowledgement Letter to specify what additional details you need and, where appropriate, request proof of identity.
What types of personal data am I likely to need to disclose in response to an employee's subject access request? +
The scope is broad. In employment it can include emails and internal correspondence where the employee is the subject, HR file notes, performance reviews, disciplinary and grievance records, payroll and pension data, sickness and absence records, CCTV footage, interview notes and recruitment records. The UK GDPR also requires supplementary information about the purposes of processing, the categories of data, recipients, retention and the employee's rights. Some information may be withheld where a specific exemption applies, for example confidential references, legally privileged documents or third-party personal data, but exemptions must be applied document-by-document with documented reasons. Under the Data (Use and Access) Act 2025 your search need only be reasonable and proportionate, not exhaustive.
