Yes, to the extent of the personal data you process about them. You do not assess the reason for the request, including any planned litigation. You do not have to hand over the entire email mailbox, but the employee must receive a faithful and intelligible copy of their data and, where necessary to understand it, extracts or complete documents. You may protect colleagues' and clients' data and trade secrets by redacting them. The GDPR leaves only narrow scope for refusing the entire request. You must respond without undue delay and within a month of receiving the request. For a complex request, the deadline may be extended with notification.
The employment relationship has ended, and a few weeks later the former employee submits a request for “all personal data, including emails”. The request indicates that they are gathering material for a lawsuit, for example to challenge the validity of their dismissal. However, the right of access under Article 15 of Regulation (EU) 2016/679 (the GDPR) does not depend on the reason for the request, so it must be handled. The scope of the response is determined by the personal data the company processes about the employee.
You do not assess the motive for the request
In its judgment of 26 October 2023 in Case C-307/22 (FT v DW), the Court of Justice of the EU held that the GDPR does not make provision of the first copy conditional on giving a reason, and the controller cannot require one. Nor may a request be refused because it pursues an objective other than checking the lawfulness of processing. In that case, a patient requested a copy of his medical records to pursue a claim against his dentist. In its Guidelines 01/2022 on the right of access, the European Data Protection Board expressly gives the example of a dismissed employee gathering evidence for a lawsuit and states that the employer does not assess the employee’s intention.
The first copy is free of charge. Apart from charging for additional copies, the GDPR permits charging a fee for a request or refusing it only where it is manifestly unfounded or excessive, particularly because of its repetitive character, and the controller must demonstrate that this is the case (Article 12(5)). According to the Board, there is very limited scope for treating an access request as manifestly unfounded.
What the response must contain
The employee is entitled to confirmation of whether you process their data, access to that data and information about the purposes, categories of data, recipients, retention period, source, their rights and any automated decision-making (Article 15(1)). If the request was made electronically, you must respond in a commonly used electronic form unless the employee requested another method (Article 15(3)). The response must also include a copy of the data:
The following quotation is reproduced in its original language:
Prevádzkovateľ poskytne kópiu osobných údajov, ktoré sa spracúvajú.
According to the Court of Justice, the term “copy” refers to the personal data contained in the documents. The copy must be complete, faithful and intelligible. Where context is necessary to understand the data, it must also include extracts from documents or complete documents (C-307/22, paragraphs 72 to 75, referring to the judgment in C-487/21 of 4 May 2023). For emails, this means the employee’s personal data in messages they wrote or received, or in which they are mentioned, rather than automatically the entire contents of their work mailbox. In guidelines adopted before the judgment, the Board accepts that emails do not always need to be forwarded in their original form and that correspondence containing the employee’s data may be compiled into a single file, provided its content remains unchanged. Where it would be unintelligible without context, provide extracts or complete messages.
If you process a large quantity of information about the employee, you may ask them to specify the data or activities to which the request relates (recital 63 of the GDPR). The Board cautions that clarification must not be used to narrow the response. If the employee confirms that they are requesting all their data, it must be provided in full. When asking for clarification, therefore, describe the systems and areas of administration in which their data is held.
What you may protect
The right to a copy must not adversely affect the rights and freedoms of others (Article 15(4)). Recital 63 expressly mentions trade secrets and intellectual property; the Board adds other people’s personal data, such as that of colleagues and clients, and the confidentiality of correspondence. According to the Board, a general concern is insufficient. The company must be able to demonstrate a specific adverse effect. Protecting others should result in redaction, rather than refusal of the entire response. The company’s economic interest in withholding the data is not, in itself, a valid reason.
Deadlines and the difference between Slovakia and Czechia
You must provide information on the action taken on the request without undue delay and no later than 1 month after receiving it. For a complex request or a larger number of requests, the deadline may be extended by a further 2 months. However, you must inform the employee of the extension and the reasons for it within 1 month (Article 12(3)). If you do not comply with the request, you must inform them within the same period of the reasons and of their right to lodge a complaint with the supervisory authority and seek a judicial remedy (Article 12(4)).
Slovak Act No. 18/2018 Z. z. does not give an ordinary company any additional basis for restricting the right of access. Its Section 30 on restrictions of data subjects’ rights is in the second part, which does not apply to processing governed by the GDPR (Section 3(2) of Act No. 18/2018 Z. z.). Czech Act No. 110/2019 Sb. allows the rights under Articles 12 to 22 of the GDPR to be applied proportionately or compliance with them to be deferred where necessary and proportionate to safeguard a protected interest. Such interests include protecting the rights and freedoms of persons and enforcing private-law claims (Section 11(1) and Section 6(2) of Act No. 110/2019 Sb.), and the restriction must be notified to the supervisory authority without undue delay (Section 11(2)). Whether a company may rely on this exception when responding to a request from an employee who is preparing a lawsuit is a matter of interpretation in the particular case.
We will review the request with you, help identify where the employee’s data is stored, prepare a response containing all mandatory information and recommend what to redact and why. We will establish a procedure for handling data subject requests as part of our GDPR and personal data protection service. If you would like an external professional to receive and handle requests on an ongoing basis, see our data protection officer (DPO) service.
This answer provides general information on the law as at 3 October 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
