Data Governance toolkit: your rights under UK GDPR
Your personal data is your evidence. UK GDPR gives you the legal keys to unlock it — here's how to use them strategically.
1. Introduction: your data is your evidence
In a dispute with your employer, evidence is everything. Your personal data — held in your employer's emails, server files, and HR systems — is a treasure trove of that evidence. The UK General Data Protection Regulation (UK GDPR) gives you the legal keys to unlock it.
These rights are powerful tools for transparency and accountability. An organisation's response to your data rights request is a huge test of their culture and how seriously they take their legal duties.
This guide shows you how to use these rights strategically. Don't wait for your employer to finish their slow internal processes. Acting early protects your evidence, strengthens your legal position, and puts you in control.
2. Core principles of data governance (Article 5)
Organisations must comply with these principles when handling your data:
- Lawfulness, fairness, and transparency: your data must be handled lawfully and openly.
- Purpose limitation: data collected for one reason cannot be repurposed without justification.
- Data minimisation: they should only collect what they actually need.
- Accuracy: your data must be accurate and kept up to date.
- Storage limitation: data should not be kept longer than necessary.
- Integrity and confidentiality: your data must be kept secure.
- Accountability: the organisation must be able to demonstrate compliance with all of the above.
3. Your key rights in a dispute
These are the rights that matter most when you are gathering evidence or challenging an employer's records.
Right of access (Subject Access Request)
The right: you can demand a copy of all your personal data, plus information on how it is being used, who it is shared with, and where it came from.
The power: a SAR unlocks emails about you, HR notes, meeting minutes where you were discussed, and internal messages. It is free, and they must respond within one month.
The strategy: be specific about date ranges, names of individuals likely to have discussed you, and systems to search (email, HR systems, messaging platforms). A targeted SAR is harder to stall than a broad one.
Right to rectification
You can demand that inaccurate or incomplete personal data be corrected without undue delay. If an organisation has made a defamatory or incorrect statement about you in their records, you can use this right to force them to correct it.
Right to erasure / "right to be forgotten"
This is your right to have your personal data deleted in specific circumstances. It is not an absolute right and can be refused if the organisation needs the data for the establishment, exercise, or defence of legal claims.
Right to restrict processing
This is your right to "freeze" your data. If you believe your data is inaccurate or is being used unlawfully, you can request that its processing be restricted. This legally requires the organisation to preserve the data as-is but prevents them from using, altering, or deleting it.
You can use this right on its own or combine it with a request to correct inaccurate data (rectification). This is a powerful strategic move during a dispute.
Right to notification
If an organisation rectifies, erases, or restricts processing of your data, they must communicate that change to any third parties they have shared your data with, unless it proves impossible or involves disproportionate effort.
The legal duty to preserve evidence ("litigation hold")
Separate from GDPR, there is a fundamental legal principle that once a party knows a formal dispute is likely, they have a duty to preserve all relevant evidence. Deliberately deleting relevant records can have serious legal consequences for an organisation.
Strategic tip: in your grievance or appeal letter, include a sentence stating: "Please ensure all data relevant to this matter is preserved pending the outcome of this formal process and any potential future legal proceedings."
4. How to submit an effective SAR
- Put it in writing (email is fine) to the HR or data protection team, and state clearly that it is a Subject Access Request under Article 15 UK GDPR.
- Name your search terms: your name, initials, email address, and any nicknames or project codenames used for you.
- Set the scope: date ranges, named individuals, and specific systems — email accounts, HR files, messaging platforms.
- Ask for the metadata too: confirmation of the purposes of processing, the recipients of your data, and its source.
- Keep the proof: save the sent email. They have one calendar month to respond; a two-month extension is only allowed for complex requests, and they must tell you.
5. What to do if they ignore or refuse your request
- Challenge them: send a formal written response, citing the specific GDPR articles you believe they have breached.
- Escalate to the ICO: if you're still unsatisfied, you can complain to the Information Commissioner's Office (ICO) within three months of the organisation's last meaningful response.
6. What if they punish you or withhold your data?
Exercising your data rights is a legally protected activity. If your employer treats you unfairly, punishes you, or deliberately withholds your data after you make a request, this is unlawful. This can include actions like:
- Suddenly denying you a promotion or training opportunity.
- Excluding you from meetings or becoming hostile.
- Ignoring or refusing your valid data request specifically to obstruct your case.
This treatment can fall into two legal categories:
- Unlawful detriment: in employment law, you suffer a "detriment" if you are put at a disadvantage for asserting a legal right. Punishing you for making a SAR — or deliberately withholding the data you've requested — are classic examples.
- Victimisation: this has a specific legal meaning under the Equality Act 2010. It happens when you are punished for a "protected act," such as making a discrimination complaint. If you use a SAR to gather evidence for a discrimination claim and your employer withholds the data or treats you badly as a result, this is a clear case of victimisation.
Both are illegal, and you could bring a separate claim to an employment tribunal for this treatment.
The tools in this guide, from a Subject Access Request to a formal Preservation Notice, are not polite requests — they are your legal entitlements under UK law. Exercising your data rights is a powerful and strategic way to create transparency, secure evidence, and hold organisations accountable. Use these rights to protect yourself and ensure your personal data is handled with the care the law demands.
Institutional records, not personal data?
If you need policies, meeting minutes, or spending records from a public body rather than data about you, that's a Freedom of Information request.