Why your right to see your own HR record matters more, not less

A right hiding in plain sight

Under UK GDPR and the Data Protection Act 2018, anyone can ask their employer for a copy of the personal data held about them: a subject access request. Most employees have never made one, and plenty of managers have never handled one, which is exactly why it is worth setting out plainly rather than assuming everyone already knows the rules.

What it actually covers

It is broader than a payslip history. It covers appraisal notes, disciplinary and investigation records, health data, which carries extra safeguards as special category data, and, importantly, the outputs of any profiling or automated scoring a system has produced about that person. If a tool scored, flagged, or ranked someone, that output is part of their personal data too, and it is not exempt from a request just because a system produced it rather than a person.

The timeline

An employer has one calendar month to respond, running from the date the request is received, not from whenever someone gets around to acting on it. That can be extended by up to two further months if the request is complex or if the same person has made several requests, but the employer has to say so, and why, before the original month is up. It is generally free to the person asking, with a fee only chargeable if a request is manifestly unfounded or excessive.

What changed this year

The ICO refreshed its guidance on this right in early 2026, reflecting the same Data (Use and Access) Act 2025 reforms covered elsewhere in this series. The clock can now pause while an employer reasonably seeks clarification of a vague request, the standard for how thoroughly you must search is now described as reasonable and proportionate rather than exhaustive, and any refusal notice must now state the complaint routes open to the person asking.

The one-month clock does not start when you find the papers. It starts when they ask.

Why AI raises the stakes here, not lowers them

The automated decision-making safeguards covered earlier in this series and the subject access right work alongside each other, not instead of one another. Article 22C gives someone the right to know a significant decision was automated and to contest it. The subject access right is how they actually get to see the detail behind it, the score, the flag, the data the system used. Together, they are the difference between being told a decision was automated and actually being able to check it.

This is also why a business cannot treat an automated tool's internal workings as somehow exempt from a request. If a scoring system produced a number that fed into a decision about someone, that number is their personal data. A request that asks to see it is not asking for anything special, it is asking for exactly what the law already says they can have.

A worked example

An employee disputes the outcome of a disciplinary process and asks to see their full record. A business with scattered records, some in email, some in a shared drive, some in someone's head, spends most of the one-month window just finding everything. A business with one accessible HR file can pull the same information together in an afternoon, and actually use the rest of the month to check it properly rather than searching for it.

What people get wrong

The most common mistake is treating a subject access request as adversarial by default, something to be managed defensively rather than answered plainly. Most requests are not the opening move of a claim, they are exactly what the right is for: someone wanting to understand their own record. Responding openly and on time is usually what keeps a request from turning into something more contentious, not what causes it.

What this means for how your records are kept

Jamie HR keeps a person's records in one exportable place, which is precisely what turns a subject access request from a scramble into an afternoon's work. The one-month clock does not care how organised your filing was when it started.