When HR Won't Release Your Personnel File: Exemptions Used

Your Personnel File Request Has Come Back Incomplete

You submitted a Subject Access Request to HR. What arrived was not your full personnel file. Instead, you received a bundle with large sections blacked out, entire documents withheld, or a letter explaining that certain records cannot be disclosed. This is frustrating, particularly if you need those records for an ongoing dispute or potential tribunal claim.

There are situations where employers are legally permitted to withhold certain information from a SAR response. But they also sometimes apply exemptions too broadly or refuse material they should have disclosed. Understanding which exemptions exist, and where their limits lie, helps you decide whether to challenge the refusal.

Exemptions Employers Commonly Rely On

The UK GDPR and Data Protection Act 2018 contain several exemptions that employers use when responding to personnel file requests. These are the ones you are most likely to encounter.

Third party data: If a document contains personal data about other people, your employer can redact their names and identifying details. This commonly affects manager notes, investigation witness statements, and emails copied to colleagues. The test requires a fair balance: your employer must weigh your right to access against potential unfairness to the third party. Disclosure may still be appropriate if the third party has consented, if the information can be anonymised, or if it is reasonable in all circumstances to disclose without consent. Generic job titles or department references often should not be redacted.

Management forecasts and planning: Records relating to management planning about you, such as internal discussions about your future role, restructuring decisions, or performance improvement considerations, may be withheld under Schedule 2, Part 1 of the Data Protection Act 2018. This exemption protects genuine forward planning, not retrospective records of decisions already made.

Legal professional privilege: Advice from in house counsel or external solicitors about your employment situation is usually exempt. This applies to legal advice privilege and litigation privilege. However, routine HR guidance that happens to come from a legally qualified person does not automatically attract privilege.

Confidential references: The rules here are specific. An employer who gave a reference about you does not have to disclose it to you. But if your current employer received a reference about you from a previous employer, they must disclose it. The exemption protects the giver, not the receiver.

Grievance and disciplinary investigations: Investigation notes, interview records, and internal reports often contain third party data and may involve legal advice. Employers frequently redact heavily or withhold entire investigation files. Some redaction is legitimate, but blanket refusal usually is not.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

Time Limits and Extensions

Your employer must respond to a SAR within one calendar month of receiving it. They can extend this by a further two months if the request is complex or they have received multiple requests from you. If they extend, they must tell you within the first month and explain why.

If your employer missed the deadline entirely or extended without proper justification, this is a procedural breach. While the ICO rarely imposes direct penalties for isolated deadline failures, raising the breach with them often prompts employers to cooperate and complete their response.

What You Can Do Now

Start by writing to your employer's Data Protection Officer. Most organisations of any size have one. Ask them to review the redactions and withholdings, specifying which exemptions you believe have been applied too broadly. Request a written explanation for each category of withheld material. Give them two weeks to respond before escalating.

If the DPO response is unsatisfactory or you receive no response, you should file a formal complaint with the ICO. The ICO handles complaints about SAR failures and can order disclosure. There is no fee. If you are a union member, consider asking your representative to support your complaint or correspondence with your employer.

Maintain a detailed log of your SAR request attempts, employer responses, dates, and email chains. If you are heading towards an employment tribunal claim, the documents you have been refused may become disclosable through tribunal disclosure rules. Tribunals can order production of documents an employer refused to release under a SAR. Note which specific documents were withheld and the reasons given.

Be aware that ICO investigations take time, often several months. If you have tribunal deadlines approaching, you may need to proceed with your claim and seek disclosure through that process rather than waiting for the ICO. If internal processes and the ICO route have not resolved matters, consider seeking legal advice on your options.

To understand the detailed procedures involved, review the ICO website at ico.org.uk and the relevant sections of the Data Protection Act 2018 on legislation.gov.uk.

The Next Step