Compliance
Can employees request their performance reviews? GDPR subject access requests for HR
Yes, employees can usually see their performance review under GDPR — including ratings, manager notes and calibration comments. What a subject access request covers, the one-month deadline, the exemptions, how to redact, how long to keep review data and how to write reviews that hold up when disclosed.
By the CLEAR Talent team8 min readLast reviewed
Key takeaways
- A performance review is the employee’s personal data, and so are the opinions about them in manager notes and calibration comments.
- You have one month to respond, extendable by two further months only for complex or numerous requests — and you must say so within the first month.
- Exemptions are narrow: protect other people’s data and legally privileged advice, but awkward wording is not a reason to withhold.
- Write every review comment on the assumption the employee will read it, because they can.
Sooner or later an employee asks for “everything you hold on me”. Often it arrives during a dispute about a rating, a missed promotion or an improvement plan, and the HR team discovers that the review is not one document but a trail of forms, notes, calibration spreadsheets and emails.
This guide answers the question HR teams in Ireland and the EU actually search for: can an employee access their performance review under GDPR? It covers what counts as personal data, the deadline, the exemptions, redaction, retention and how to write reviews you would be comfortable disclosing. It is general information, not legal advice.
The short answer: yes, and it covers more than the final form
Article 15 of the GDPR gives every individual the right to confirmation that their personal data is being processed, a copy of that data and supporting information: why it is processed, who receives it, how long it is kept and where it came from. Employees are not a special case. A request does not need a form, a reason or the words “subject access request”; an email to their manager can be enough.
Opinions count. In Nowak (C-434/16) the Court of Justice held that an examiner’s comments on a candidate’s script were the candidate’s personal data. A manager’s assessment of an employee’s performance is the same kind of information, so the right of access reaches well beyond the signed-off rating.
What counts as personal data in a performance review
Anything that relates to an identifiable employee is in scope, wherever it is stored. In a typical review cycle that includes:
- Ratings and the final review
- Overall and competency ratings, goal scores, the narrative and any rating that was later changed.
- Manager notes
- Draft comments, 1-on-1 notes and journal entries about the employee, including informal ones kept outside the HR system.
- Calibration comments
- What was said about the employee in a calibration meeting, why a rating moved and any ranking or talent-grid placement.
- 360 feedback
- Comments about the employee from peers and reports — which are also, often, the rater’s data.
- Emails and messages
- Correspondence that discusses the employee’s performance, pay outcome or promotion case.
The one-month deadline and how to meet it
Article 12(3) requires a response without undue delay and within one month of receiving the request. Where requests are complex or numerous you can extend by two further months, but you must tell the employee within the first month and explain why. The response is normally free; a reasonable fee or a refusal is possible only where a request is manifestly unfounded or excessive, and the burden of showing that sits with you.
You may confirm identity where there is genuine doubt, and you may ask the employee to clarify what they want where you hold a large amount of data. The Data Protection Commission (DPC) and the EDPB’s guidelines on the right of access both treat that as clarification, not a way to narrow the request or stop the clock indefinitely.
Supply the data as it stood when the request arrived. Routine processing can continue, but deleting or rewriting review comments because a request has come in is exactly what the right of access exists to prevent.
Exemptions: what you can withhold, and what you cannot
- Other people’s data
- Article 15(4) says the right to a copy must not adversely affect the rights of others. A colleague’s rating, a 360 rater’s identity or a third party’s health information can be redacted where disclosure would harm them and you cannot reasonably obtain consent.
- Legal privilege
- The Data Protection Act 2018 restricts the right of access for data covered by legal professional privilege, such as advice from your solicitor about a dismissal risk. HR’s own notes are not privileged simply because a dispute is possible.
- Other statutory restrictions
- The 2018 Act allows further restrictions in limited cases. They are applied narrowly, case by case, and the DPC expects you to be able to explain any you rely on.
- Not exemptions
- Embarrassment, “it was only a draft”, the fact that the employee may be preparing a claim, or a comment being stored in a personal notebook or private chat rather than the HR system.
Redaction in practice
Redact to protect someone else, not to tidy the record. Start from the full set of documents, remove only what identifies or concerns another person, and keep a note of each redaction and the reason. A manager writing in their professional role is usually named: the employee is entitled to know who assessed them, and their name is rarely sensitive in that context.
360 feedback needs the most care. Where raters were promised anonymity, the comments about the employee can usually be disclosed with identifying details removed, or as the aggregated report the employee already saw. If a comment is so specific that it identifies its author, weigh the rater’s interests against the employee’s before deciding.
The Court of Justice confirmed in C-487/21 that a “copy” means a faithful reproduction of the data, including extracts of documents where they are needed to understand it. A summary in HR’s words is not enough.
Every redaction should have a reason you could give the DPC in one sentence.
How long to keep performance review data
The GDPR sets no fixed retention period. Article 5(1)(e) says personal data must be kept no longer than necessary for its purpose, so you set the period and must be able to justify it. Most employers keep reviews for the duration of employment plus a defined period afterwards linked to the claims they might need to defend, and they write that period into a retention schedule.
Two practical points follow. Your privacy notice must state the period, because the employee is entitled to it in a DSAR response. And manager notes in personal folders or chats tend to outlive the schedule, so they are disclosed long after they should have been deleted.
See how CLEAR Talent handles DSARs, access and audit logging
How to write reviews that survive disclosure
- Write for the employee as reader
- If you would not say it to them in the review meeting, do not write it in a note about them.
- Evidence, not adjectives
- Cite dated examples and the agreed standard. “Missed three of four agreed deadlines in Q2” survives scrutiny; “lazy” does not.
- Keep health and personal life out
- Record the performance gap and the support offered. Absence and medical detail belongs in the appropriate HR record, handled as special category data.
- Record why a rating moved
- A calibration change with a stated reason reads as fair; an unexplained downgrade reads as the opposite.
- Use the system, not side channels
- Comments in private messages are still disclosable, and are harder to find within the month.
An HR checklist for performance review DSARs
Checklist
Responding to a DSAR that covers performance reviews
Work through this with your DPO, and keep the completed list on the request file.
Day one
- Log the date received and calculate the one-month deadline
- Acknowledge the request and verify identity only if genuinely in doubt
- Tell managers not to delete or edit anything about the employee
Gather
- Export review forms, ratings, goals and 360 results from the performance system
- Collect manager notes, calibration records and relevant emails or messages
- Decide within the first month whether an extension is justified, and tell the employee
Review and respond
- Redact third-party data and privileged advice, recording the reason for each
- Add the supplementary information: purposes, recipients, retention period and source
- Send securely, and keep a copy of exactly what was disclosed
A note for UK readers
The UK GDPR and the Data Protection Act 2018 follow the same structure, with the Information Commissioner’s Office (ICO) as regulator. The UK Act has exemptions that Ireland’s does not mirror in the same form, including for confidential references and management forecasting, and the Data (Use and Access) Act 2025 has amended the access regime. Check the ICO’s current guidance rather than relying on Irish practice.
Where CLEAR Talent fits: the audit trail and DSAR exports
CLEAR Talent cannot decide what to disclose or redact; that judgement stays with HR and your DPO. What it changes is the gathering. Reviews, goals, 360 results, development notes and the performance journal sit in one place, so HR can answer a DSAR with an export rather than searching inboxes and spreadsheets by hand.
The audit log records who changed what and when, and review stages close on the dates you set, so you can show how a rating was reached and that it was not quietly amended afterwards. Reviews export to PDF or Excel, 360 raters are anonymised within their group, access is role-based, and right-to-be-forgotten workflows support your retention schedule.