Subject Access Requests: Take Control of Your Workplace Rights
If you’ve been treated unfairly at work, you don’t have to sit in the dark. You can shine a light on what’s really going on behind closed doors. If your manager has been sending messages about you or plotting your future, you have the right to see those communications. It’s your data. Your story. Your proof.
This page shows you how to use a subject access request to uncover the truth, and how to turn that knowledge into power.
What Is a Subject Access Request?
A subject access request (SAR) is your legal right under UK GDPR to ask for every piece of personal data your employer holds about you.
That means emails with your name on them. Notes about your performance. HR files. Even Slack messages or WhatsApp chats that mention you. It’s all fair game — because it’s about you.
When you make a SAR, you’re not asking for a favour. You’re demanding what’s already yours.
Why Make a Subject Access Request?
Because information is power.
When you’re left in the dark, it’s easy for employers to twist the story. But when you see the raw data - the messages, the memos, the whispers - the truth speaks for itself.
A SAR can expose bias, show hidden motives, or confirm what you’ve suspected all along.
Sometimes, just making the request is enough to make your employer realise you’re serious. Other times, it gives you the evidence you need to fight for a fair outcome or negotiate a stronger exit.
How to Submit a Subject Access Request
You don’t need a lawyer to do this. You write to your employer or their data protection officer, asking for every piece of personal information they hold about you.
Be focused. Be clear. Ask for what matters: specific people, timeframes, and types of communication: emails, messages, meeting notes, and so on. If you’re too broad, your employer might try to delay or dodge by calling your request “manifestly excessive.”
Keep it sharp, and they’ll have no excuse.
What Happens Next
Once you’ve sent your request, your employer has one month to respond. They can stretch that by up to three months only if the request is unusually complex — and they must explain why.
Most of the time, the information must be given to you for free.
What you get back could change everything: internal emails, HR notes, maybe even proof that you’ve been targeted or pushed out. Use that evidence wisely. It can turn an uneven fight into a fair one.
How Grapple Law Helps You
Grapple Law is your AI-powered legal ally, built to help you uncover the truth and act fast. You talk directly to the AI, not a human lawyer. It listens, analyses, and instantly gives you clear, practical steps to take control.
Our AI can:
- Draft and send your subject access request — focused, firm, and legally sound.
- Analyse the response you receive, explaining what it really means in plain English.
- Map out your next move, from negotiating your exit to challenging unfair treatment.
No waiting for callbacks. No confusing legal talk. Just instant answers that help you act with confidence.
Grapple Law Prices
There are currently three tiers of pricing:
Grapple Free: Quick legal insights — up to 15 questions a day.
Grapple Advice (£20/month): Unlimited analysis, plain-English summaries of your rights, and clear next steps.
Grapple Negotiate (£50/month + 10% of any settlement): Generates and sends professional legal letters and emails to your employer.
You don’t have to face workplace injustice alone.
Subject Access Request FAQs
What is in a subject access request?
All personal data your employer holds about you — emails, notes, HR files, and messages.
How long do you have to make a subject access request?
Any time. Your employer normally has one month to respond.
How to make a subject access request?
Write or email your employer asking for all personal data they hold about you. Grapple Law’s AI guides you step by step.
What cannot be requested in a subject access request?
Employers can withhold data that includes other people’s personal information or legally privileged content.
How long to respond to a subject access request?
Usually one calendar month, though they can extend up to three months in complex cases.
