Right to Erasure vs Subject Access Request: What UK Employers Need to Know

Employees sometimes submit requests that mix up — or deliberately combine — a subject access request and a right to erasure request. Each is a separate UK GDPR right with different obligations. Handling one as if it were the other is a common mistake, and it leaves employers non-compliant with whichever right they ignored.

This guide explains the key differences, how to identify which type of request you have received, and how to handle combined requests.

This guide covers the right of access and the right to erasure under UK GDPR and the Data Protection Act 2018. It is not legal advice.

The two rights: a quick summary

Subject access request (SAR)

A SAR is a request under UK GDPR Article 15. The requester asks to see the personal data you hold about them. You respond by providing a copy of the data and supplementary information. You are not deleting anything — you are disclosing it.

Right to erasure (right to be forgotten)

The right to erasure is under UK GDPR Article 17. The individual asks you to delete their personal data. Article 17(1) sets out six grounds on which erasure must be carried out:

• (a) The data is no longer necessary for the purpose it was collected
• (b) The individual withdraws consent and there is no other legal basis
• (c) The individual objects under Article 21 and there is no overriding legitimate interest
• (d) The data has been unlawfully processed
• (e) Erasure is required to comply with a legal obligation in EU or Member State law
• (f) The data was collected in the context of an information society service to a child

The right to erasure is not absolute. Article 17(3) sets out situations where erasure does NOT apply, including where processing is necessary for:

• The exercise of freedom of expression and information
• Compliance with a legal obligation (e.g., payroll records under HMRC rules)
• The establishment, exercise, or defence of legal claims

How to tell which request you have received

Most employees use plain language rather than citing specific Articles. These phrases indicate a SAR:

• "Send me all the data you hold about me"
• "I want a copy of my file"
• "What information do you have on me?"
• "I'd like to see my personal data"

These phrases indicate a right to erasure (or possibly both):

• "Delete all my data"
• "Remove my information from your systems"
• "I want you to forget about me" or "right to be forgotten"
• "Stop processing my data and delete it"

Ambiguous phrasing:

"I want my data" could be either. If you cannot determine from context whether the individual wants a copy or wants deletion, write to ask for clarification — and use DUAA 2025 stop-the-clock to pause the response deadline while you wait.

Responding to each

Responding to a SAR

One calendar month deadline. Provide a copy of personal data plus supplementary information. Do not delete anything as part of the response. For the full process, see How to Respond to a Subject Access Request from an Employee.

Responding to a right to erasure request

Step 1 — Check which Article 17(1) ground the requester is relying on. If they haven't specified, consider which ground(s) could apply.

Step 2 — Check whether an Article 17(3) exception applies:

• If the data is held for legal claims (disciplinary records in pending tribunal proceedings), erasure can be refused
• If retention is required by law (payroll records, HMRC requirements), erasure can be refused for that category
• If processing is for legitimate interests and the balance tips in your favour, consider the Article 21 objection process (different from erasure, but related)

Step 3 — Respond within one calendar month. The right to erasure has the same one-month deadline as a SAR. The extension rules (two further months for complex cases) also apply.

Step 4 — If granting erasure: Delete the data from all systems — not just the primary record but also backup systems, archive copies, and any systems where the data has been replicated. Document what you deleted, from which systems, and when.

Step 5 — If refusing erasure: Explain in writing which exception applies, and inform the requester of their right to complain to the ICO. Partial erasure is possible — you may need to delete data from some systems but retain it in others.

Combined requests: SAR + right to erasure together

A request that says "I want to see all my data AND then have it deleted" is a combined request. Handle each part separately:

1. Process the SAR first. Provide the copy of data within the SAR deadline. You cannot refuse the SAR because an erasure request follows it — these are independent rights.
2. Then process the erasure request. The erasure runs its own deadline from the date received.

You do not have to delete data before completing the SAR. In practice, you cannot provide a copy of data that no longer exists — so the sensible order is: disclose first, then delete (subject to any valid grounds for refusing erasure).

The employment context: why erasure requests are complex

For employees and ex-employees, right to erasure requests almost always run into legitimate retention obligations:

• Payroll records: HMRC requires retention for a minimum period
• Pension records: long-term retention obligations
• Disciplinary and grievance records: legitimate interest in retaining during limitation periods for employment tribunal claims (typically three months for unfair dismissal; six years for breach of contract)
• Sickness absence records: legitimate interest in retaining where relevant to ongoing management

An erasure request from a former employee does not mean you must delete their entire employment record. It means you must assess each category of data against the grounds for retention. For most core employment records, you will have a legitimate reason to retain data up to your stated retention period — and the requester's right to erasure does not override that.

Where the two rights intersect

A SAR response may prompt a subsequent erasure request. The requester sees what you hold, then asks you to delete certain categories. This is a common pattern after settlement agreements, redundancies, or disciplinary proceedings.

Be ready for this sequence. When your SAR response goes out, consider noting in your cover letter that if the requester wishes to exercise any other rights — including erasure — they should submit a separate request clearly identifying the right they are exercising.

For the full process on handling third-party data within a SAR response, see SAR Third-Party Data Redaction. For how SAR responses interact with employment tribunal strategy, see Subject Access Requests and Employment Tribunals.

Checklist: right to erasure request

• Identified which Article 17(1) ground the requester relies on
• Checked each Article 17(3) exception against your data categories
• Documented which data will be deleted and which retained, with reasons
• Confirmed which systems hold the data and what deletion from each system means
• Responded within one calendar month
• If refusing (fully or partially): explained the exception and signposted the ICO complaints route
• If granting: confirmed deletion from all live systems, scheduled deletion from backup/archive systems, and documented the deletion log

Sources

• UK GDPR — Article 15 (right of access)
• UK GDPR — Article 17 (right to erasure)
• UK GDPR — Article 21 (right to object)
• ICO — Individual rights guidance (including right to erasure)

---

This guide provides general information about the right to erasure and subject access requests under UK GDPR. It is not a substitute for legal advice.