Subject Access Request Letter: Free Template and What to Include

If you need to request all personal data held about you by your employer, a written letter is the recommended first step — it creates a clear record and shows you're pursuing the matter formally. Below is what a strong subject access request should include.

What this letter needs to cover

• State it is a Subject Access Request under Article 15 UK GDPR
• Request all personal data held
• Specify categories of data of interest (emails
• HR records
• Disciplinary records etc)
• State that a reply is due within one month of receiving the request
• Provide contact details for response

Requesting your full employment records

Under UK GDPR, you're entitled to a copy of all personal data your employer holds about you — this includes performance reviews, disciplinary records, emails mentioning you, and HR notes, not just the basic personnel file. This right applies regardless of whether you're still employed or have already left.

What to include before you send it

• A clear statement that you're making a Subject Access Request under UK GDPR
• Confirmation of your employee reference or personnel number if known
• Any specific categories of data you're particularly interested in, if helpful for prioritisation
• A note of the one-month statutory response deadline

Why this is often used alongside a grievance or tribunal claim

Requesting your full personal data can reveal internal communications, notes, or assessments relevant to a dispute that you wouldn't otherwise see — this is a legitimate and commonly used tool when preparing for a grievance, disciplinary appeal, or tribunal claim.

Frequently Asked Questions

Can my employer refuse to provide certain information?
Some exemptions exist, such as information that would identify another individual without their consent, or genuinely privileged legal advice, but these are narrower than employers sometimes assume.

What if my former employer ignores this request after I've left?
Your right to make a Subject Access Request isn't affected by your employment ending — you can complain to the Information Commissioner's Office if it's ignored.

[Your Name]
[Your Address]
[Your Postcode]
[Your Telephone Number]
[Your Email Address]
[Name of Contact / Data Protection Officer]
[Company Name]
[Company Address]
[Company Postcode]
[Date]

Dear [Name of Contact / Data Protection Officer],

Subject: Subject Access Request (SAR)

I am making a Subject Access Request under Article 15 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please supply all the personal data you hold about me.

To help you find the information, I am particularly asking for:
• My complete personnel file, including performance reviews, contracts and disciplinary records.
• All emails, internal messages and meeting minutes that mention me, sent between [Start Date, e.g. 1 January 2026] and [End Date, e.g. 31 August 2026].
• All records about [specific incident or investigation, e.g. my recent grievance], including any investigator's notes.

This information should be provided free of charge and within one calendar month of receiving this request. Please send it to [your email or postal address]. If you need anything to confirm my identity, please let me know as soon as possible.

Yours sincerely,

[Your Signature]
[Your Printed Name]