Data protection law can be used by individuals to obtain copies of their personal information. From an employer this may include the employee’s personnel file. Organisations must comply with GDPR’s (General Data Protection Regulation) rigorous provisions. Basic information about this area of law is available at the Information Commissioner’s website at ico.org.uk
