Process

Access requests that HR can answer without panic

When an employee asks for their data, the people team often freezes between legal fear and inbox chaos. A small intake habit changes the tone.

Start with a single mailbox owner

Designate who acknowledges the request within one business day. The acknowledgment does not need a full package — it needs a timestamp, a contact person, and a request for clarification if the ask is vague (“all my data” across every system).

Scope before you collect

List systems that likely hold employment records: ATS, payroll, performance tools, badge logs, manager email folders that store personal notes. Collecting everything at once creates risk and delay. Ask which period and which processes the employee cares about, then expand only if needed.

Flag sensitive slices early

Health-related notes, investigation files, and data about other people need careful handling. Your intake form should force the reviewer to mark these slices before anyone hits “export.” That is where counsel or the DPO enters — not after a zip file is already sitting in a shared drive.

Close the loop in writing

When you respond, note what was included, what was withheld and why at a high level, and how the employee can ask follow-up questions. The paper trail protects both the individual and the organization.

Want structured practice? The access-request module inside our flagship course rehearses this path with German workplace examples.