The right of access allows any individual-employee, former employee, or job candidate-to find out whether their employer is processing data about them and to obtain a copy. This is what Article 15 of the GDPR provides, under the supervision of the CNIL in France.
This right goes beyond simple consultation. The employer must confirm whether processing exists, provide the data itself, and supply specific details about the purposes, categories of data, recipients, and retention periods.
Any individual whose data is processed by their employer can request: confirmation of the processing, a copy of the data, and information about how it is used.
Three points to keep in mind before going further:
- Employees, former employees, and job candidates can all exercise this right.
- The process is free in principle, but fees may apply for additional copies in certain justified circumstances.
- The employer has a limited time to respond, which may be extended in complex cases.
Key Points
The right of access to HR data requires the employer to confirm, communicate, and explain an employee's personal data within a reasonable timeframe, free of charge in principle, and with third-party information filtered out.
| Point | Details |
|---|---|
| - | - |
| Clear legal basis | Article 15 of the GDPR applies to employees, former employees, and candidates, with precise response requirements. |
| Deadline to respect | One month in principle, extendable by two months for complex or voluminous requests. |
| Free by default | Only additional copies requested after an initial response may be charged for. |
| Mandatory filtering | Third-party data and trade secrets must be removed before any transmission. |
| Automate filtering | Safe-Doc pseudonymizes HR documents in real time to accelerate compliant responses without storing them. |
Table of Contents
- What is the right of access to HR data under Article 15 of the GDPR?
- What must the employer provide in response to an access request?
- Who can exercise this right and how is identity verified?
- How do you actually exercise the right of access to HR data?
- Response times and cost: what the law actually provides
- Where does the right of access stop regarding third parties and work emails?
- How should HR respond in practice to an access request?
- What recent decisions and CNIL guidance change
- What internal procedure should be implemented to handle an access request?
- Why pseudonymization makes processing access requests easier
- What this right really changes in the employer-employee relationship
- Reducing risk in HR responses with automated filtering
- Sources
What is the right of access to HR data under Article 15 of the GDPR?
Article 15 of the GDPR gives any data subject the right to obtain confirmation that processing of data concerning them exists and, if so, to access that data along with a range of supplementary information. This includes the purposes of the processing, the categories of data concerned, the recipients (or categories of recipients) to whom the data has been or will be disclosed, and the envisaged retention period.
This provision didn't appear out of nowhere. It forms part of a broader European framework, where the Charter of Fundamental Rights of the European Union recognizes the protection of personal data as a right in its own right. The EDPB guidelines clarify how to apply this requirement in practice, particularly regarding the notion of an "intelligible" copy and how it relates to the rights of others.
Why does this right actually exist? Three reasons stand out:
- Transparency: an employee must be able to know what their employer knows about them, without resorting to indirect channels.
- Verification of lawfulness: accessing your data allows you to verify that the processing is based on a valid legal basis.
- Accuracy control: incorrect data in an HR file (a misfiled evaluation, an outdated address) can have real consequences, and access is often the first step before a rectification request.
This right therefore doesn't only concern the curious or employees in conflict with their employer. It's part of a set of tools, alongside the rights of rectification and objection, that give everyone real control over their own data.
What must the employer provide in response to an access request?
A compliant response goes beyond a vague email confirming "yes, we have a file." Article 15 of the GDPR imposes specific content requirements, and the CNIL regularly reminds employers what this means in practice.
The employer must provide:
- Explicit confirmation that processing of personal data exists.
- A copy of the relevant personal data concerning the individual (pay slips, performance reviews, administrative correspondence, disciplinary notes as applicable).
- The purposes of the processing (payroll management, career tracking, security, etc.).
- The categories of data concerned and their recipients, internal or external.
- The envisaged retention period, or the criteria used to determine it.
- The existence of any automated decision-making, with an explanation of its logic where applicable.
In practical terms, this communication can take several forms: a summary table of the data processed, a secure PDF export, or a direct copy of the relevant documents where appropriate. The format matters less than the substance, provided the individual can actually understand what's being done with their information.
Securing this transmission deserves particular attention. Sending a complete HR file via unencrypted email, or posting it to a shared space accessible to the entire team, exposes the company to a data leak risk that has nothing to do with the original request. The CNIL's HR reference framework emphasizes that access to HR data must remain limited and traceable, including when responding to access requests.
Who can exercise this right and how is identity verified?
The right of access isn't reserved for current employees. It extends to former employees, whose data may still be retained for specific legal periods, and to job candidates whose CVs and interview notes have been recorded in an applicant tracking system.
An individual may also authorize a third party to act on their behalf: a lawyer, a relative with written power of attorney, or a staff representative in certain collective contexts. In all cases, the employer must ensure that the request comes from the data subject or their duly authorized representative.
On identity verification, the CNIL recommends a proportionate approach: the doubt must be reasonable, and the proof requested must be appropriate to that doubt. An employee who sends their request from their usual work email address generally doesn't need to prove their identity with an additional document.
Pro tip: Avoid systematically requesting a copy of an ID card for every request. This practice, though apparently prudent, often constitutes disproportionate data collection and can be seen as a disguised obstacle to exercising the right.
How do you actually exercise the right of access to HR data?
Exercising this right requires neither a lawyer nor complex procedures. Here's how to proceed:
1. Identify the recipient of the request: the HR department, the company's data protection officer (DPO) if one exists, or the employer directly for a small organization.
2. Specify the scope of the request: which data, over what period, in what context (disciplinary file, annual review, payroll records). A targeted request generally gets a quicker and more complete response than a generic one.
3. Choose a traceable channel: an email with delivery confirmation, registered mail, or the internal contact form if available. The Service-Public website also offers reusable letter templates.
4. Structure your request: identity, role or status (employee, former employee, candidate), precise description of the data sought, and explicit reference to Article 15 of the GDPR.
5. Keep proof of sending: this record will be useful in case of non-response or incomplete response.
If the employer doesn't respond within the legal deadline, or if the response appears clearly incomplete, a written reminder remains the logical first step. If there's no reaction after this follow-up, two avenues are available: filing a complaint with the CNIL, which can conduct an investigation, or recourse to the courts for the most blocked situations.
Response times and cost: what the law actually provides
The principle is straightforward on paper: the employer has one month to respond from receipt of the request, in accordance with Article 12.3 of the GDPR. This period may be extended by two additional months when the request is complex or concerns a large volume of data, provided the individual is informed within the first month and the extension is justified.
On cost, the rule is equally clear: exercising the right of access is free in principle. The employer can only charge fees for additional copies requested after an initial response has been provided, and these fees must remain reasonable in relation to actual administrative costs, as the CNIL specifies.
An extension is justified, for example, when an employee requests their entire file covering fifteen years of service, spread across multiple HR systems and paper archives. Conversely, a request for the last three pay slips generally doesn't warrant any additional time.
Where does the right of access stop regarding third parties and work emails?
The right of access relates to personal data, not to the automatic delivery of entire documents. This distinction makes a significant difference in practice. A work email that mentions an employee may contain information about other colleagues, clients, or matters covered by trade secrets. The employer isn't required to transmit this document in its entirety: they must extract the data concerning the requester.
This filtering obligation isn't optional at the employer's discretion-it's a legal requirement. The CNIL explicitly states this for work emails: the employee can request access to emails concerning them, but the employer must first remove or mask any elements relating to third parties not concerned by the request.
Several situations require particular vigilance:
- Third-party data: names, contact details, or evaluations concerning colleagues must be redacted before any transmission.
- Trade secrets: a commercial strategy mentioned in an email doesn't become disclosable simply because an employee is copied on it.
- Private correspondence: exchanges of a strictly personal nature, even sent from work email, benefit from enhanced protection.
- Voluminous requests: when an employee requests all their exchanges over ten years, the employer may request clarification to target the request, without rejecting it outright.
In practice, the main difficulty comes from work emails. The distinction between metadata (sender, date, subject) and message content isn't always easy to apply, and recent case law shows tension between the employee's right to access their exchanges and the risk of using this right purely for evidentiary purposes in employment disputes. Recent legal analyses also emphasize that this right, though nearly fundamental, is not absolute: an employer can challenge a request that is manifestly excessive or diverted from its original purpose, provided they can prove it.
Pro tip: When faced with a voluminous request covering years of emails, don't try to extract everything manually. Prioritize automated extraction followed by targeted human review: it's faster, more reliable, and reduces the risk of missing third-party data.
How should HR respond in practice to an access request?
A compliant response relies on a process, not case-by-case improvisation. Here's the structure that works best in most companies:
- Receipt and timestamping: record the exact date of receipt, which starts the one-month legal deadline.
- Scope identification: list the systems concerned (HRIS, payroll, messaging, disciplinary files) likely to contain data about the individual.
- Targeted extraction: extract only relevant data, without copying entire folders for convenience.
- Third-party redaction: systematically mask references to other individuals.
- DPO validation: when the company has one, a review before sending limits the risk of error or omission.
- Secure transmission: favor an encrypted channel or protected exchange space rather than standard email.
Logging deserves special mention. Knowing who accessed which data, who extracted it, and to whom it was transmitted constitutes valuable proof of diligence in case of a CNIL audit. The CNIL emphasizes this point: access traceability is one of the pillars of compliant HR management, just like technical security.
A minimal checklist is often sufficient to secure this process: acknowledgment of receipt sent within 48 hours, proportionate identity verification, defined search scope, third-party filtering performed before validation, and written record kept of each step. Automatic pseudonymization tools significantly lighten this burden, particularly for large files containing numerous third-party references, as detailed in our guide on protecting employees' personal data.
What recent decisions and CNIL guidance change
The right of access continues to evolve under the influence of court decisions and clarifications in European guidance. Two trends clearly emerge in recent years.
On one hand, courts and the CNIL tend to confirm the broad scope of the right of access, particularly regarding work emails containing the employee's personal data. On the other hand, case law is beginning to better frame requests that appear less motivated by a genuine need for information than by litigation strategy, particularly during dismissals or conflictual separations.
Recent legal analyses remind us that the burden of proving a possible abuse of rights rests on the employer: they cannot simply invoke the excessive nature of a request without concrete supporting evidence. This requirement pushes companies to precisely document their refusals or limitations, rather than justifying them vaguely.
On an operational level, these developments have a direct consequence: HR must be able to justify each limitation applied to a response with objective criteria (protection of identified third parties, demonstrated trade secrets) rather than general reasons.
What internal procedure should be implemented to handle an access request?
A written procedure, even a brief one, avoids many errors when a request actually arrives. Here are the steps it should cover:
1. Acknowledge receipt within 48 to 72 hours, specifying the start date of the one-month legal deadline.
2. Verify the requester's identity proportionately, without systematically requiring an identity document.
3. Map the relevant data across all pertinent HR systems before beginning extraction.
4. Check for third parties and trade secrets before any transmission, methodically filtering the relevant references.
5. Send an extension notification if the additional two-month period proves necessary, briefly explaining the reason.
6. Justify any partial refusal in writing, citing the concrete elements warranting the limitation (identified third parties, data covered by legal secrecy).
7. Archive the entire process: date of receipt, exchanges, extraction performed, validation, sending date.
Three short templates are sufficient to cover most cases: a standard acknowledgment of receipt, an extension notification stating the reason for complexity, and a reasoned refusal notification precisely listing the excluded data and why. Keeping these templates ready saves valuable time, especially for companies that receive multiple requests per year.
Why pseudonymization makes processing access requests easier
Pseudonymization and anonymization aren't synonymous, and this difference matters for HR. Pseudonymization replaces direct identifiers with coded references while retaining the ability to return to the original data via a secure correspondence table. Anonymization permanently removes any possible link to the individual. To respond to an access request, it's reversible pseudonymization that has value: it protects third parties mentioned in a document while maintaining the integrity of data concerning the requester.
The recommended technical workflow follows simple logic: extraction of relevant documents, automatic pseudonymization of third-party references, final human validation by the DPO or legal department, then secure delivery to the requester. In practice, it's more efficient to automate this third-party detection rather than manually redacting each file one by one-a slow method prone to human error on large files.
The concrete benefits are measured across three dimensions. First, time: automated extraction processes in minutes what would take hours of manual review. Second, auditability: each pseudonymization action can be logged, providing proof of diligence in case of an audit. Finally, reduced residual risk, provided you precisely document which data was masked and why, rather than relying on a quick visual review.
What this right really changes in the employer-employee relationship
Transparency about HR data isn't just another regulatory constraint. It directly affects trust between an employer and their teams, and that trust is built or broken at the precise moment when an access request lands on the HR department's desk.
Companies that anticipate this moment, with clear procedures and appropriate tools, avoid three common pitfalls: delays that expose them to CNIL complaints, poorly justified refusals that poison already tense relationships, and third-party data leaks through haste. Conversely, those who discover Article 15 of the GDPR at the very moment when a former employee in conflict files their request often find themselves urgently handling what should have been a well-established routine.
This observation, seen across numerous HR files, argues for a simple principle: treat compliance with the right of access as a permanent HR competency, not as a topic discovered with each dispute.
Reducing risk in HR responses with automated filtering
Properly responding to an access request often involves combing through entire files-from work emails to annual reviews-to extract only what concerns the requester without disclosing colleagues' data. Safe-Doc automates this filtering step: the platform detects and pseudonymizes over 90 types of sensitive data in a document in real time, without durably storing it.
In practical terms, this means fewer hours spent manually redacting emails or reports, and an exportable audit trail to prove diligence in case of a CNIL audit. The service remains compatible with tools already used internally, without changing HR teams' working habits. For HR professionals who want to understand how this pseudonymization works in practice with your personnel files, the Safe-Doc HR page details the functionality, and the team can arrange a demonstration using your own use cases.
Sources
To learn more about your rights or obligations, a few official references are worth more than ten general guides:
- Employees' right of access to their data and professional emails | CNIL
- EDPB guidelines on data subject rights - access (FR version) | EDPB
- Exercise your right of access to personal data | Service-Public
- Employees' right of access: a quasi-fundamental right but not an absolute right | NMCG
In case of an unsatisfactory response or complete lack of reaction, the CNIL can be contacted with a complaint, free of charge and online.
This article provides general information and does not substitute for advice from a qualified attorney. Consult a qualified legal professional about your specific case before acting on this content.