When Someone Asks What You Hold

General orientation, not legal advice.

A request for a copy of someone's data arrives most often alongside a grievance about pay or lateness. In this deployment it is answerable in minutes if the design was right.

What you will produce

Their punches: times, sites, accepted or flagged.

The coordinates and accuracy figures still within retention.

Refusals and their causes.

Corrections, with who made them and why.

Any notes attached to their record.

Not: other people's data, which is easy here because punches are individual.

The rehearsal

Do it once, on a volunteer, before it arrives during a dispute.

Produce everything for one person for a month.

Time it.

Read it as they would.

Two things usually turn up: data in places nobody remembered — an export on a shared drive, the vendor's copy — and a free-text note written in a tone nobody would want to defend.

Why short retention helps here

A request for three months of punches is a table.

A request for three years of coordinates is a map of someone's arrivals, and producing it demonstrates to them how much was held.

It is also the moment employers discover their retention was not what they believed.

Deleting coordinates early makes this request small, which is a practical argument alongside the legal one.

Where it gets awkward

A punch from home, which the record now contains and which they may not remember making.

A refused punch with no logged cause, which leaves you unable to explain your own decision.

Notes. Anything written about the person is disclosable, and "again" reads exactly as it sounds.

Write records as if they will be read, because eventually one will.

Responding

Within the statutory period for your jurisdiction.

In a readable form — a table, not a data dump.

With the accuracy figures explained, because a coordinate without its uncertainty invites a wrong conclusion in both directions.

And with the same care you would want, since how a request is handled frequently determines whether the dispute escalates.

After

Note what the request revealed about where data lives.

Delete the strays, tighten the exports, shorten the retention.

A request is expensive once and cheap afterwards if the first is used to clean up.

Rehearse it on a volunteer

Before it arrives during a dispute.

Produce everything for one person for a month.

Time it, and read it as they would.

Two things usually turn up: data in places nobody remembered, and a note written in a tone nobody would want to defend.

Both are worth finding now, and the second is the one that costs a case.

Turn the principle into a test

For an example that can make this requirement testable, consult review the data-flow example. Treat the page as a starting point rather than proof and reproduce the workflow with real roles and failures.

Independent reference

For an external point of reference, see ICO guidance. Use this established source as an external check before turning the principle into a workplace rule.