The UK’s Data (Use and Access) Act has updated the UK GDPR framework, introducing important updates to Subject Access Requests (SARs) and general workplace data handling in February 2026.
Designed to streamline data access while upholding privacy standards, these regulatory shifts directly impact how businesses track and retain employee information. For HR and operations teams, managing clocking systems, attendance logs and timecard records now requires a clearer alignment with new legal standards.
Navigating these changes means understanding new compliance obligations while ensuring your workforce management processes are fully transparent, secure and easy to use daily.
What are the key updates impacting HR and Workforce management?
The Act adjusts the UK GDPR framework to ease friction around compliance whilst ensuring accountability. HR teams now must adapt their routine workflows to align with updated requirements for employee inquiries, data processing plus workplace automation.
Here is a quick breakdown of the updates:
Reasonable and proportionate searches – Employers are now explicitly required to perform ‘reasonable and proportionate’ searches when responding to requests, which prevents unnecessary data hunts.
Formal internal complaints process – Organisations must implement a recognised internal data protection complaints policy, requiring initial complaints to be addressed in-house before being escalated to the Information Commissioner’s Office (ICO).
Automated decision-making safeguards – Rules around automated software have been updated, allowing more flexibility for automated workplace processes provided that staff are informed and have access to human review.
Updated privacy notices – Employee privacy policies must clearly state how workplace data, including shift, location and clocking records, are logged, processed and retained.
How SAR rules affect attendance and clocking data
Time and attendance records represent a significant portion of employee personal data requested during a SAR.
Understanding the boundaries of clocking data helps streamline response times and prevents data disputes, including:
- Defined request scope – Employees can request raw clocking logs, timesheets and biometric verification timestamps, but searches only need to cover relevant proportional parameters.
- Third-party data redaction – Attendance records that capture details about colleagues, such as shared shift notes or supervisor signoffs; must have third-party personal details redacted before export.
- Strict one-month timelines – The standard response window remains one calendar month from the date of identity verification, though extensions of up to two months are permitted for complex requests.
Best practices for storing, exporting and securing attendance records
Attendance data needs to be handled with strict security controls and structured retention policies. Fragmented records across multiple spreadsheets increase the risk of regulatory breaches and delayed SAR responses.
Here are four best practices:
- Centralise time tracking – Store all clocking times, absences and shift logs in a single, unified database rather than decentralised file systems.
- Enforce strict access controls – Restrict access to attendance records based on role-based permissions, ensuring managers only view data essential to their immediate duties.
- Automate data retention rules – Implement automated cleanup schedules to permanently remove historical clocking logs once their legitimate business or statutory lifecycle expires.
- Ensure export readiness – Utilise software that allows quick, secure exports of individual employee records in standard formats like CSV or PDF.
FAQs
Does an employee have to use the official term “SAR” when asking for attendance logs?
No, a request can be submitted informally in writing or verbally. Any clear request from an employee asking to view their clocking logs, timesheets, or historical attendance triggers your statutory obligation.
Do we have to search every historical system for clocking data?
Under the updated rules, your search must be ‘reasonable and proportionate’. You are expected to search primary databases and accessible archives, but you do not need to conduct exhaustive or unfeasible technical retrievals.
Can we charge an employee a fee to provide their time and attendance records?
In almost all circumstances, fulfilling a SAR must be done completely free of charge. Fees can only be charged if a request is demonstrably, manifestly unfounded or excessive.
How long should we keep clocking and attendance data?
Data should only be kept as long as necessary for business, legal or statutory purposes. Align your data retention policy with statutory payroll and working time regulations, deleting records safely once those requirements pass.
Simplify SAR compliance with Capture it™
Fulfilling Subject Access requests doesn’t have to be time-consuming. Capture it™ features a secure, centralised database that organises all your time, attendance and workforce data in one central location
With powerful search, filtering, and automated export tools, Capture it™ makes retrieving employee clocking records fast, accurate, and fully compliant with current UK GDPR rules.
Discover how Capture it™ can safeguard your business records and streamline your HR operations by getting in touch now.
Contact Us
