Subject access requests for employees in Ireland
Your HR file, your manager's emails, the notes from that meeting: under the GDPR, employees and former employees can ask their employer for a copy of the data it holds about them. It's called a subject access request. It's usually free, and they normally have one month to reply.
Every employer has to answer, whatever its size. There's no minimum number of staff.
[Your name][Date]
Subject access request
Dear Data Protection Officer,
Under Article 15 of the GDPR, please send me a copy of all personal data you hold about me, including my HR file, emails and messages about me, and notes of meetings about me.
I worked for you as [job title] from [date] to [date].
Please reply within one month.
Be specific and you get a faster, fuller answer.
"What has my manager written about me?"
"Can I see the notes from my disciplinary?"
"What did you record about my grievance?"
"How was I scored for redundancy?"
"Why didn't I get the job?"
"What does the monitoring software record about me?"
Examples only, not real requests.
The law also gives you the story around your data, so you can see how it's being used.
Your HR file, emails and chats about you, meeting notes, appraisals and recordings, wherever they keep them.
What they use it for, and who they've shared it with, such as payroll, pension or occupational health providers.
How long they'll keep it, where they got it if not from you, and whether decisions about you are automated.
Four steps. About five minutes.
1
The staff privacy notice usually names a data protection contact. If there isn't one, send it to HR.
2
Name the records you want, the people involved and the dates. It helps them search the right inboxes.
3
Note the date they received it. They may check your identity before the clock starts.
4
Complex requests can take up to two more months, but they must tell you why within the first month.
The clock is one calendar month, not 40 days. The old 40-day rule ended in 2018.
That's often allowed. They must tell you why and which part of the law they're relying on.
Witnesses and co-workers can be blacked out, unless it's reasonable to share them. Your manager's name usually stays.
Your employer's communications with its lawyers, covered by legal privilege (section 162).
An opinion about you given in confidence, such as a reference (section 60).
Data needed for a legal claim, where holding it back is necessary and proportionate (section 60).
An email that mentions you in passing isn't all your data. Unrelated parts can go.
Most requests get answered. When one doesn't, work through these in order. Each one is free.
Quote your request date and the deadline. A polite chaser often settles it.
If they have a data protection officer, write to them directly and give a short deadline.
The Data Protection Commission is Ireland's regulator and can look at how they handled it.
You can bring a data protection action in the District, Circuit or High Court. It's the last step, so get legal advice first.
Guides for the moments employees most often ask, with what to request and what to expect back.
Answer a few questions and get a letter to copy, email or print. What you type stays on your device.