DSARs as a Tactical Weapon: An Employer’s Survival Guide
Employers are increasingly facing tactical Data Subject Access Requests (DSARs) from employees during grievances, disciplinaries and Employment Tribunal claims. This practical guide explains how UK employers can respond to a DSAR lawfully under UK GDPR and the Data Protection Act 2018, manage the one‑month deadline, use exemptions appropriately and protect their litigation strategy while maintaining compliance.
If your business receives a Data Subject Access Request (DSAR) from a current or former employee, particularly during a grievance, disciplinary process or employment dispute, it is rarely just an administrative exercise.
In many cases, an employee DSAR is used strategically to obtain information ahead of Employment Tribunal proceedings or to strengthen their negotiating position. While the right of access is fundamental under UK data protection law, employers are not without protection. Understanding how to respond to a DSAR properly can significantly reduce legal risk and avoid unnecessary disclosure.
This guide explains how DSARs operate under UK GDPR, how they are used in employment disputes, and how employers can respond in a legally compliant and commercially sensible way. For a broader practical overview of subject access requests during employment disputes, including grievances and disciplinary processes, see our article ‘’.
What is a DSAR?
A Data Subject Access Request (DSAR) allows an individual to obtain confirmation that their personal data is being processed and to receive a copy of that data, together with prescribed supplementary information. This right arises under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as reflected in the Information Commissioner’s Office (ICO) guidance on the right of access.
For employers, this means that employees, former employees and job applicants can request access to personal data held about them across a wide range of systems, not just HR files. This commonly includes emails, internal messaging platforms, investigation notes and informal communications. A key point often misunderstood is that a DSAR relates to personal data, not documents. This distinction is critical when determining what must actually be disclosed.
How a DSAR is used in employment disputes
It is increasingly common for DSARs to be submitted shortly before or after allegations of unfair dismissal, discrimination or whistleblowing. There is nothing improper in this. The ICO is clear that an individual’s motive is generally irrelevant. However, in practice, DSARs are frequently used to obtain early visibility of evidence that may later be relied upon in litigation.
Typical objectives include identifying internal discussions about disciplinary decisions, uncovering inconsistencies in investigations, or finding comments that could support allegations of bias or pre-determination.
For employers, the timing is often deliberate. A wide-ranging DSAR can create immediate operational pressure, particularly where large volumes of data must be reviewed within a short timeframe.
Can employers refuse a tactical DSAR?
A common misconception is that a DSAR can be refused simply because it is made in the context of a dispute but that is not the case. The right of access applies regardless of motive, including where litigation is contemplated or ongoing. However, employers are not required to comply blindly with every request.
A DSAR may be limited or refused in part where it is manifestly unfounded or excessive, although this is a high threshold and must be supported by evidence. More commonly, employers rely on specific statutory exemptions to withhold or redact information.
The key is to approach the request critically and lawfully, rather than treating it as an all-or-nothing exercise.
Common employer mistakes with a DSAR
Many of the risks associated with DSARs arise from avoidable misunderstandings. Employers often focus only on personnel files, when in reality relevant personal data is spread across multiple systems. Equally, some assume that every document mentioning the employee must be disclosed, which is incorrect and can lead to over-disclosure.
Another frequent error is failing to properly identify legally privileged material. Legal advice communications will generally be exempt, but this must be assessed carefully.
Delay is also a recurring issue. The one-month deadline begins on receipt, and organisations are expected to act promptly, even where the request is wide or inconvenient.
Managing the one-month DSAR deadline
The statutory timeframe is one of the most challenging aspects of responding to a DSAR, particularly in larger organisations.
Employers should move quickly to scope the request, identify relevant data sources and begin proportionate searches. Where necessary, the request can be clarified, and the response period may be extended by up to two further months for complex cases, provided this is communicated within the initial month.
Crucially, organisations should document their approach. A clear audit trail of search terms, custodians and decision-making will assist if the response is later challenged by the ICO or in litigation.
What can be withheld?
Employers are required to provide personal data, not entire documents. This allows for redaction and, in some cases, withholding of information.
Legal professional privilege is one of the most important exemptions, particularly where employment lawyers are advising on disputes. In addition, employers must consider the rights of third parties whose personal data may appear in the same documents.
There are also limited exemptions relating to management planning and negotiations, although these are narrowly interpreted and should be applied with care. The exercise is often one of balance. Over-disclosure can be as problematic as non-compliance.
Proportionate searches and ICO expectations
The ICO does not expect organisations to conduct unlimited or speculative searches. The requirement is one of reasonableness and proportionality.
This involves focusing on systems and individuals most likely to hold relevant personal data, rather than attempting to capture every possible reference. The scope of the request, the volume of data and the resources available are all relevant factors. A defensible, well-reasoned search strategy is far more important than an exhaustive one.
DSARs and Employment Tribunal disclosure
DSARs are often confused with disclosure obligations in Employment Tribunal proceedings, but they serve different purposes. Disclosure in litigation is driven by relevance to the issues in dispute, whereas a DSAR is concerned only with personal data. Although there may be overlap, compliance with one does not automatically satisfy the other.
Employers should be particularly careful to align their DSAR response with their broader litigation strategy to avoid inconsistencies or unintended disclosure.
Risks of getting it wrong
Poor handling of an employee DSAR can have wider consequences than many businesses anticipate. Complaints to the ICO can lead to regulatory scrutiny, while individuals may seek court orders to enforce compliance. In the context of employment disputes, mistakes can weaken an employer’s position and increase the cost and complexity of settlement negotiations or tribunal proceedings.
There is also a reputational dimension, particularly for regulated businesses or those managing sensitive workforce issues.
Preparing in advance
The most effective way to deal with DSARs is to prepare before one is received. Clear data retention policies, disciplined internal communications and well-organised document management systems can significantly reduce the burden of responding. Equally, having an internal DSAR response protocol ensures that HR, IT and legal teams can act quickly and consistently. These steps are not just about compliance. They materially improve an employer’s position if a dispute arises.
When to seek legal advice
Legal advice is particularly valuable where a DSAR arises alongside allegations of discrimination, whistleblowing or unfair dismissal, or where litigation is already in progress. It is also advisable where privilege, senior personnel or commercially sensitive material are involved, or where the request is unusually broad.
Early input can help narrow the scope of disclosure, protect privileged material and ensure that the response supports the employer’s wider strategy.
Frequently Asked Questions: Private Road Ownership & Maintenance
In most cases, no. A fee can only be charged in limited circumstances, such as where a request is manifestly unfounded or excessive, or where further copies of information are requested. Generally, no. Ongoing or anticipated Employment Tribunal proceedings do not automatically remove an individual’s right of access under data protection legislation. Not always. Some emails may be protected by legal professional privilege or other statutory exemptions, whilst others may require redaction to protect the personal data of third parties. The usual deadline is one month from receipt. This may be extended by up to two additional months where the request is particularly complex, provided the individual is informed within the original one-month period. Potentially, yes. If business communications contain personal data relating to the individual and are held by the employer, they may fall within the scope of the request. Missing the deadline can lead to complaints to the Information Commissioner and may increase the risk of regulatory scrutiny or court proceedings. It can also undermine the employer’s position in any related employment dispute. Not simply because it is tactical. The right of access applies whatever the employee’s motive, even where a dispute or tribunal claim is ongoing or expected. A request can only be limited or refused in part where it is manifestly unfounded or excessive, which is a high threshold that must be supported by evidence. More often, employers rely on specific legal exemptions to withhold or redact information. Approach the request critically and lawfully, rather than as an all-or-nothing exercise. No. A DSAR gives the employee a right to their personal data, not to entire documents. That allows employers to redact information and, in some cases, withhold it, for example, legally privileged advice, or other people’s personal data that appears in the same documents. Assuming every document must be handed over is a common mistake that leads to over-disclosure, which can be as problematic as not complying. The exercise is one of careful balance. No. The two are often confused, but they serve different purposes. Tribunal disclosure is driven by what is relevant to the issues in the dispute, whereas a DSAR is concerned only with the employee’s personal data. There may be overlap, but complying with one does not automatically satisfy the other. Make sure your DSAR response is aligned with your wider litigation strategy, to avoid inconsistencies or unintended disclosure.
How the Jonathan Lea Network can help
Responding to a DSAR in the context of an employment dispute requires more than a technical understanding of data protection law. It requires a coordinated legal and strategic approach.
We advise employers across Sussex, London and throughout England and Wales on tactical employee DSARs and employment disputes, including scoping requests, conducting proportionate searches, applying exemptions and protecting legally privileged material. We also ensure that DSAR responses are aligned with ongoing grievances, disciplinary processes and Employment Tribunal proceedings.
Contact Us
We will respond to most enquiries with an indicative scope and fee estimate and the offer of a complimentary 20-minute discovery video call before sending a more considered formal fee estimate via email.
In limited cases, we may offer a fixed-fee appointment, commonly charged at £750 plus VAT, including document review, a video consultation and an advisory email, as well as an estimate for further work.
Please email wewillhelp@jonathanlea.net or call 01444 708640. We will need an overview of the background and issues, together with significant documents, to provide an indicative scope and fee estimate.