When an employee asks to see what data you hold on them

Echipa HR 365 · reviewed 2026-09-12 · 5 min read

The request comes rarely — usually in a tense context, at a departure or during a conflict — and that is precisely why it catches you unprepared. The hard part is not the answer, it is finding the data: if you do not know how many places it lives in, you cannot answer completely, and an incomplete answer gets noticed and looks bad.

What to prepare before the request arrives

Three things, once

1. HR — an inventory of the places employee data exists, including spreadsheets and vendors
2. HR — a one-page written procedure: who receives the request, who gathers, who checks, within what time
3. HR — a response format prepared in advance, so that it is not built under time pressure

The first point decides whether you can answer at all. In a company where data lives in seven or nine places, gathering it takes days — and some of it is simply missed because nobody remembered it existed.

What the response contains

The last row produces the most internal debate. The useful distinction is between data processed systematically — which forms part of your records — and ordinary correspondence, which is not a database. Where you are in doubt, ask someone qualified rather than deciding in a hurry.

What is generally not included

• Other people’s data appearing in the same documents — redacted before handover.
• A manager’s personal notes, which are not company documents and do not circulate.
• Internal decision documents that also concern other people, in their complete form.
• Information that would reveal confidential processes unrelated to the person.

How you answer

Calmly, completely, and without asking why. The reason for the request does not matter, and asking about it turns a normal procedure into a confrontation. The practical formula: acknowledge receipt, say by when you will respond, and meet the deadline.

If the answer needs time — because the data sits in several places — say so, with a realistic date. An announced delay is acceptable; a silent one turns a routine request into a suspicion.

What you learn from the first request

The first request is, in practice, the best audit of your data organisation you can run. It shows you exactly how many places exist, which are hard to reach, where data is duplicated and contradictory, and how long gathering it takes.

It is worth noting, immediately afterwards, what took longest and what was hard to find. By the second request — and there will be one — the process becomes an hour rather than a week.

Can I charge a fee or ask for a justification?

The healthy practice is to ask for nothing: it is a normal request, and any added friction turns a routine procedure into a signal of bad faith. What is legally permitted is checked separately, but is rarely worth using.

What if the request arrives during a conflict?

Exactly as at any other moment. Different treatment — slower, more defensive, with questions — is what turns a routine request into a bigger problem.

Do I have to include their reviews?

Formal reviews concern them and are, as a rule, part of the response. A manager’s informal notes are a different matter. Where it is unclear, ask someone qualified before answering, not afterwards.

Where to start

Run the exercise on yourself: gather everything that exists about you in the company, as if you had asked. How long it takes and what you cannot find is the answer to whether you are ready.

Then write the one-page procedure. Not for compliance — so that on the day the request arrives, nobody improvises under pressure.

Who handles it, in practice

One person coordinates, even though the data comes from several places. Without a named coordinator, the request circulates between HR, accounting and IT, each assuming somebody else has answered — and the deadline passes.

The last row dictates the timetable: if you have to request something from an external vendor, that is the activity that determines the deadline. You start with it, not with everything else.