Section 56 Data Protection Act 1998 prohibits an employer from requiring an individual or third party to provide information that the individual or third party has obtained in response to a subject access request under s.7 of the Data Protection Act 1998. An employer requiring individuals to provide these records will commit a criminal offence punishable by a fine. . XpertHR