Reasons the law accepts
- Other people's details, such as colleagues or witnesses, unless they agree or it's reasonable to share them. A manager acting in their job is usually named.
- Communications between your employer and its lawyers are covered by legal privilege and don't have to be disclosed.
- References about you given in confidence can be held back, whether your employer wrote them or received them.
- Records of management planning, such as redundancy proposals, can be held back while sharing them would harm the business. Once decisions are made, that reason usually falls away.
- Information that isn't about you. A document that mentions you in passing isn't all your data, so unrelated parts can go.
What they should tell you
They should tell you that they've held something back and why, unless saying so would itself defeat the purpose. A reply that's blacked out with no explanation is worth questioning.
If you think too much was removed
- Write back, quote your request, and ask which reason applies to each part that was removed.
- Ask whether anything was held back entirely, not just blacked out.
- If you're still not satisfied, use their data protection complaints process, and if that doesn't work, complain to the ICO.
What to put in your request
- An explanation for each part removed
- Confirmation of whether anything was withheld entirely
Related guides
Sources: UK GDPR Article 15; Data Protection Act 2018, Schedule 2; Data (Use and Access) Act 2025; Acas Code of Practice on disciplinary and grievance procedures; ICO guidance on the right of access. Last reviewed 7 October 2026. General information about UK data protection law, not legal advice. If you're in a dispute with your employer, speak to a solicitor, your union or Acas.