Subject Access Requests - grievances and discrimination claims

Summary

Under the UK General Data Protection Regulation (UK GDPR), individuals have the right to request access to their personal data held by an organisation. This right applies to employees, clients, and any other individuals whose personal data is processed by the law firm. Employers cannot charge a fee for complying with a SAR unless the request is manifestly unfounded or excessive. The response to a SAR must be in an easily accessible format, such as a digital copy. A Data Subject Access Request (DSAR) allows an individual to request personal data held about them by an organisation under the UK GDPR. In disciplinary or grievance situations, employees may use a DSAR to access records such as emails, meeting notes, or investigation reports. This can help them understand the case against them or support their claims. Employers must respond within one month and provide relevant data unless exemptions apply (e.g. third-party confidentiality). Failure to comply can lead to complaints to the ICO. For employees, it’s a strategic tool; for employers, it requires careful data management and compliance to avoid legal risks. As examples of how a DSAR may impact disciplinary or grievance.

Key information

• Disciplinary -an employee accused of misconduct submits a DSAR and discovers internal emails discussing the case before they were formally informed, suggesting potential bias or procedural flaws.
• Grievance \- an employee raising a grievance uses a DSAR to obtain meeting notes and emails that show management was aware of issues (e.g. bullying) but failed to act, strengthening their complaint.
• Mitigation \- a DSAR reveals inconsistencies in witness statements or documentation, which the employee uses to challenge the fairness of the process.
• Informal requests - SARs can be informal, ranging from specific requests like “can I see my last appraisal?” to broad ones like “what data do you hold on me?”
• Clarify requests - it’s acceptable to ask for clarification on vague or broad SARs, especially when dealing with extensive employee records.
• Reasonable judgment - employers have discretion to determine what data to disclose or withhold, considering factors like privacy and confidentiality.
• Risk assessment - consider potential risks and liabilities associated with the SAR.
• Comprehensive search - conduct a thorough search of all relevant systems and records.
• Identify sensitive information - determine if any sensitive or confidential information needs to be redacted or withheld.
• Protect sensitive information - redact any sensitive personal data that is not directly relevant to the SAR.
• Anonymise third-party data - anonymise any personal data belonging to third parties to protect their privacy.
• Accurate and complete information - provide accurate and complete information, but avoid disclosing unnecessary details.

Practical guidance

• Source: Subject Access Requests - grievances and discrimination claims

Related topics

More in this area

• Appealing against a disciplinary decision
• Asbestos Claims
• Can You Be Made Redundant While On Maternity Leave?
• Can an Employer Monitor Your Personal Phone Usage at Work?
• Check if you can take time off work