After termination of employment, an employee requests access to their personal data. Should we provide all documents in which their data appear?

ANSWER

When fulfilling the right of access, the employee should be provided with copies of their personal data that are processed by the employer, and not necessarily all documents or other media in which those data are contained. For example, the employee may be provided with extracts from documents containing their personal data, rather than entire documents.

As regards the period for which information must be provided, the GDPR does not specify a particular timeframe. In the case of an employee who worked for 15 years, data processed during that period should be provided, provided they are still retained in accordance with the data retention policy and the principles arising from Article 5 GDPR.