Most employees think of the GDPR as something between companies and their customers. In an employment dispute it is much more than that: the access request under Art. 15 GDPR forces your employer to disclose, within one month, essentially everything it has stored about you — HR-file entries, performance notes, investigation material and more — and it is one of the most underused sources of leverage in German exit negotiations. Exercising this right is not a trick; it is a statutory entitlement the CJEU protects vigorously. Used properly alongside a dismissal-protection claim, it shifts information asymmetry — and often the settlement number — in the employee’s favour.
What Art. 15 GDPR actually gives you
The Auskunftsanspruch has three components:
- Confirmation whether the employer processes personal data about you (it always does).
- Access and a copy of that data (Art. 15(1) and 15(3) GDPR).
- Meta-information: the purposes of processing, the categories of data, the recipients (including external providers and group companies abroad), the storage periods, the data’s source, and the existence of any automated decision-making or profiling.
In the employment context, „personal data” is broad. It covers master and payroll data, performance reviews, manager notes about you, entries in ticket and CRM systems, access logs, absence records, internal investigation files — and emails or chat messages in which you are named or discussed, not merely those you sent or received.
The scope battles: copies of emails and documents
Employers like to answer with a thin, two-page summary. Whether you can demand full copies of every email that mentions you is genuinely contested. The CJEU has held that the right to a „copy” means a faithful and intelligible reproduction of your personal data and can extend to entire documents or extracts where that is necessary for you to exercise your rights effectively. The BAG, on the other hand, has dismissed one broadly framed email-copy claim for lack of procedural specificity (2 AZR 342/20) — the claim must describe precisely enough what is demanded. The honest position: the outer boundaries remain unsettled, and careful drafting decides most of these fights before they reach a judgment. Third-party rights are handled by redaction, not by blanket refusal.
The one-month deadline
The employer must respond without undue delay, at the latest within one month of the request (Art. 12(3) GDPR). For complex requests the deadline can be extended by two further months — but only if the employer notifies you of the extension and its reasons within the first month. Silence, boilerplate or a token response after the deadline is a violation with financial consequences (see below). We calendar this deadline in every mandate where we deploy the request.
Personnel-file access under § 83 BetrVG — a separate right
Independently of the GDPR, every employee may inspect their complete personnel file (§ 83 BetrVG), without stating reasons, and may add written statements to it — for example a counter-statement to a warning. A works-council member may accompany you. The two rights complement each other: § 83 BetrVG gives you the file as the employer curates it; Art. 15 GDPR reaches everything beyond the file — the emails, systems and notes the file conveniently omits — and gives you copies and meta-information on top.
The tactical dimension in exit disputes
Why does a data-access request create settlement pressure? Because answering it properly is genuinely demanding for the employer: legal, HR and IT have to search mail servers, chat systems and shared drives, review the results, redact third-party data and take a documented position on retention and recipients — all within one month, in parallel to defending the Kündigungsschutzklage. And because the answer is revealing: it shows what evidence the employer actually has, when key documents were created, and whether the stated dismissal reason matches the internal paper trail.
To be clear about the framing: this is the legitimate exercise of a statutory right, and a genuine interest in knowing what your employer processes about you exists in virtually every dismissal scenario. Courts have occasionally pushed back on requests they perceived as pursued solely to generate nuisance value — which is why we draft them with a clean data-protection rationale and precise scope. Done properly, the request is unimpeachable.
Damages under Art. 82 GDPR for late or incomplete answers
If the employer answers late, incompletely or not at all, labor courts have awarded non-material damages. The amounts vary considerably — awards in the broad range of €1,000 to €10,000 appear in the case law, alongside decisions awarding less or nothing. Following the CJEU line, a mere violation is not enough: you must show some actual damage, though there is no materiality threshold, and loss of control over your data can qualify. Treat Art. 82 GDPR as a realistic supplementary claim that adds settlement weight, not as a lottery ticket.
Rectification and deletion: cleaning up warnings and monitoring data
Art. 16 GDPR entitles you to rectification of inaccurate data — relevant where HR systems contain wrong performance ratings or false incident notes. Art. 17 GDPR supports erasure of data that is no longer necessary, which adds a data-protection angle to the established claims for removal of unjustified warnings from the personnel file, and to the deletion of unlawfully collected monitoring data. The interplay between the traditional removal claims and the GDPR routes is still developing — we typically plead both.
Data portability — the limited one
Art. 20 GDPR (data portability) sounds attractive but rarely adds much for employees: it covers only data you yourself provided, processed by automated means on the basis of contract or consent, and it targets machine-readable transfer rather than disclosure. Art. 15 GDPR remains the workhorse.
How we deploy Art. 15 alongside the Kündigungsschutzklage
-
Draft the request precisely
We specify categories — HR file, performance data, investigation material, emails and messages mentioning you by name or ID, log data — so the response cannot hide behind vagueness and the claim is enforceable.
-
Calendar the one-month deadline
The request is sent in provable form. From day one, the clock runs against the employer — in parallel with the litigation timetable of the dismissal case.
-
Escalate deficiencies
Late, evasive or incomplete answers are documented and answered with a follow-up demand, an Art. 82 GDPR damages claim and, where useful, a complaint to the supervisory authority.
-
Feed the results into the negotiation
Disclosed material is cross-checked against the employer’s pleadings and used at the Gütetermin — as evidence, as credibility leverage, and as a factor in the settlement arithmetic.
Worked example
Product manager in Düsseldorf, €6,500 gross monthly, 4 years of service, dismissed for alleged underperformance. Opening offer: 0.5 monthly salaries per year of service — €13,000. Alongside the Kündigungsschutzklage we file a precisely scoped Art. 15 GDPR request.
The employer responds six weeks late and visibly incompletely. After our follow-up, the disclosure shows: the manager’s „performance log” was created in a single session two days before the dismissal meeting; an internal HR email discusses the termination decision weeks before the only documented feedback conversation; and a team-analytics dashboard had been scoring the employee without any works-council agreement.
Result at the settlement stage: severance raised to 1.0 monthly salaries per year (€26,000), plus €2,000 compensation for the late and incomplete Art. 15 response, a Grade-2 reference, and release from duties for the notice period. Total improvement over the opening offer: €15,000 — driven almost entirely by what the data request surfaced. The mechanics of court settlements are covered in our guide to the settlement agreement in court.
Frequently asked questions
Can my employer refuse because emails also contain other people’s data?
No. Third-party data is protected by redaction or partial disclosure, not by refusing your request altogether. A blanket „we cannot show you internal correspondence” does not satisfy Art. 15 GDPR.
Does the request cost me anything?
No — the first copy is free (Art. 12(5) GDPR). Employers can refuse manifestly unfounded or excessive requests, but that exception is narrow and the employer bears the burden of proving it.
Can my employer retaliate against me for filing a request?
Any detriment imposed because you lawfully exercised your rights violates the Maßregelungsverbot (§ 612a BGB) and is void. Document the timing carefully — see our article on retaliation after asserting your rights.
Can I still file the request after I have left the company?
Yes. The right does not depend on an ongoing employment relationship. Former employees use it to prepare reference-letter disputes, bonus claims and post-contractual arguments.
What if the employer simply ignores the request?
Then you enforce it before the labor court, and the ignored deadline itself becomes part of your damages argument under Art. 82 GDPR. In our experience, employers who ignored the first letter answer quickly once the claim is on file.