My former employer won't erase my personnel records. Must they?

What the Law Says

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 give individuals a 'right to erasure' — often called the 'right to be forgotten'. This applies to personal data held by employers, including personnel records — but not automatically in all cases.

Your former employer is a 'data controller' under UK data protection law and must comply with your erasure request if at least one of the conditions in Article 17(1) of the UK GDPR applies. These include: the data is no longer necessary for the purpose it was collected; you withdraw consent and there’s no other legal basis; you object to processing and there are no overriding legitimate grounds; the data was processed unlawfully; or erasure is required to comply with a legal obligation.

The employer must respond to your request without undue delay and, in any case, within one month of receipt. This deadline can be extended by two further months where the request is complex or numerous — but they must inform you within one month and explain the delay.

They cannot charge a fee for complying with an erasure request, unless it is manifestly unfounded or excessive — in which case they may charge a reasonable fee or refuse to act (UK GDPR Article 12(3)).

Statutory Text

The data subject shall have the right to obtain from the controller the erasure of personal data without undue delay...

— UK GDPR, Art 17(1) — Right to erasure ('right to be forgotten')

Statutory Text

The controller shall carry out the erasure without undue delay and, where possible, not later than one month of receipt of the request.

— UK GDPR, Art 12(3) — Time limit for compliance

Statutory Text

Section 47 of the Data Protection Act 2018 makes provision about the right to erasure in connection with processing carried out by a controller in the exercise of functions conferred by or under an enactment.

— Data Protection Act 2018, s. 47 — Right to erasure

Sources