Most employers understand that they must respond to a Subject Access Request under the UK GDPR. Difficulties often arise where a request is received shortly after disciplinary action, dismissal or the emergence of a workplace dispute. In those circumstances, a SAR can become far more than a routine data protection exercise.

I was recently instructed by the directors of a regulated SME after a former employee submitted extensive Subject Access Requests seeking payroll information, attendance records, internal communications and other records spanning a lengthy period. Having reviewed the scope of the requests and the surrounding circumstances, it appeared less like an attempt to verify personal data and more like a broad fishing expedition designed to gather material for a potential Employment Tribunal claim.

The Trap: Litigating an Employment Dispute Through a SAR

The client had already assembled a substantial volume of documentation and prepared a detailed draft response explaining why the former employee’s allegations and calculations were wrong. The intention was understandable. The risk, however, was significant.

A Subject Access Request is ordinarily a disclosure exercise, not a forum for debating the merits of an employment dispute. By providing extensive commentary, an employer can inadvertently create admissions, reveal litigation strategy or encourage prolonged argument.

A Strategic Response

My advice was to separate data protection compliance from the underlying employment issues. Appropriate retention policies were applied, third-party information was carefully protected, and the response was confined to what was required under the UK GDPR and Data Protection Act 2018. Rather than engaging in point-by-point argument, the business provided a clear, professional and legally compliant Article 15 response.

Compliance Without Concession

One of the most common misconceptions is that compliance requires capitulation. It does not. Organisations must comply with their legal obligations, but they are equally entitled to rely upon lawful retention policies, apply legitimate exemptions where appropriate and protect confidential information belonging to others.

In contentious situations, the challenge is often not identifying what information must be disclosed. The greater challenge is resisting the temptation to litigate the dispute within the SAR response itself.

FAQ

Can an employer refuse a SAR from a former employee?

Only in limited circumstances, such as where the request is manifestly unfounded or excessive. The threshold is high and advice should usually be obtained before refusing.

Do emails mentioning an employee have to be disclosed?

Potentially yes, subject to appropriate redactions and consideration of the rights of third parties.