Changes To Subject Access Requests Under The European Union General Data Protection Regulation

Under the Data Protection Act 1998 ("DPA"), both current and former employees have a right to see a copy of the personal data that their employer retains about them. Employees can engage this right by submitting a Subject Access Request ("SAR") to their employer.

Employees have a right to:

• be told whether any of their personal data is being processed;
• be given a description of their personal data and the purpose for which the employer processes it;
• be told to whom the employer discloses the information;
• be given a copy of any personal data the employer holds about them; and
• be given any sources of the data where it is possible to do so.

The employer must comply and provide a prompt response within 40 days of the written SAR. However, this can be varied in certain circumstances. For example, if the employee's data includes that of a third party.