What is a SAR?

Under Article 15 of the UK GDPR, you have the right to ask any organisation (including your employer) for a copy of the personal data they hold about you.

The organisation must respond within one calendar month of receiving the request. The first request is free; subsequent identical requests can be charged or refused as "manifestly excessive".

What you can ask for

  • A copy of the data itself.
  • A description of the categories of personal data they hold.
  • The purposes of processing.
  • The recipients or categories of recipients.
  • The retention period.
  • The source of the data if not collected from you.
  • Whether there is automated decision-making.

What they can refuse

Limited exemptions apply, mostly:

  • Information about other people (third-party data is usually redacted).
  • Legal-privilege material.
  • Material that would prejudice an investigation.

If they refuse, they must tell you why and explain your right to complain to the ICO.

A SAR is a tool, not a threat

Filing a SAR isn't a hostile act on paper, but employers can read it that way. Think about why you need the data and what you'll do with it before sending. If it's for a tribunal claim, talk to a solicitor first — there are usually better disclosure routes inside proceedings.