An ex employee has just contacted HR to ask for a copy of the last 6 payslips from when they worked here. HR can reproduce those payslips but they are not stored in that format (a new report needs to be run to produce the slips). Some of the information that would appear on the reprinted payslip would be stored by HR such as NI number, name and address.

Would this be classed as a GDPR Data Subject Access Request?

My understanding is that data needs to be both human and machine readable but not necessarily in the format originally used.

So you can give them all the right information but not necessarily in the right order.

I’m surprised GDPR has kicked in so quick – how long ago was it they worked there?

Easiest way to find out if it’s a GDPR request is to ask the person making it.

My understanding on what you need to provide is the same as wwaswas’s. With enough context to make it understandable.

GDPR rights don’t have time limits, they exist from the moment you collect the information to the point you delete it (roughly speaking).

GDPR rights don’t have time limits, they exist from the moment you collect the information to the point you delete it (roughly speaking).

Indeed, but if there’s a need to retain information then it should be retained – as per the OP’s ex-colleague asking for recent payslips – that’s a legitimate request, within reason, so to lose personal info very quickly seems the “panic” answer to GDPR.

Why can’t the company just supply the info instead of being a pain about it. It’s not like they don’t have it or haven’t supplied it previously….

Why can’t the company just supply the info instead of being a pain about it. It’s not like they don’t have it or haven’t supplied it previously….

They are supplying the info, the original question is if it qualifies as a DSAR request and therefore should be recorded in a log as such.

surely its their information so GDPR does not kick in. It pertains to information between the employer and the employee, your not giving information to a third party.

surely its their information so GDPR does not kick in. It pertains to information between the employer and the employee, your not giving information to a third party.

GDPR is all about “their” information, sharing with third parties is just a small part of it.