A subject access request (or SAR), is a written request to a company or organisation asking for access to the personal information it holds on an employee. In the UK, employees have a legal right to request this information. Although it must be in writing, a SAR can be sent to anyone in the organisation. It does not need to mention the GDPR or Data Protection Act 2018. Responding to a SAR can be very time consuming for an employer, however getting it wrong or ignoring it can be a very costly mistake. With a standard request, an employer needs to reply without delay and no longer than a month after the original receipt of the request. It is possible to extend this period by a further two months in complex cases. The Information Commissioner’s Office provide guidance to help businesses deal with SARs effectively and efficiently.