Subject Access Requests During Employment Disputes: A Practical Guide for Employers
If your business is dealing with a grievance, disciplinary process or dismissal, you may find that an employee has requested “all emails about them” or submitted a formal subject access request. It is increasingly common for Data Subject Access Requests (DSARs) to arise during employment disputes, and many HR teams are unsure what they must do next.
Handled properly, a DSAR can be managed in a way that is compliant, proportionate and commercially sensible. Handled badly, it can increase regulatory risk, drive up legal costs and undermine the employer’s position in any related Employment Tribunal claim. This practical guide is aimed at HR managers and business owners in Sussex, London and across England and Wales who are dealing with subject access requests during employment disputes. It explains how UK employers should respond to DSARs during grievances, disciplinary processes and dismissals.
What subject access requests mean for employers
A Data Subject Access Request (DSAR) is a request by an individual to access their personal data held by an organisation. Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, employees and former employees have the right to know what personal information you hold about them, why you process it, who you share it with and, in many cases, to receive copies.
For employers, this means a DSAR is not confined to the HR file. Personal data can appear in:
- HR and personnel records, including contracts, reviews, sickness and disciplinary documents
- emails and messaging platforms (Teams, Slack and similar systems)
- investigation notes, grievance and disciplinary minutes, and performance documentation
- other systems such as time‑keeping, access logs and document management platforms
DSARs are concerned with personal data, not every document that mentions the employee. That distinction is critical when deciding what you must actually disclose.
Why subject access requests arise during grievances and disciplinaries
Employment disputes often raise questions about what information was considered and how decisions were reached. Employees use subject access requests during:
- grievances about discrimination, harassment or treatment at work
- disciplinary proceedings, including performance and conduct issues
- redundancy exercises and selection processes
- situations where a dismissal has taken place or is being contemplated
Making a DSAR in these circumstances is lawful and common. The request is not designed to replace Employment Tribunal disclosure, but to give the employee visibility over how their personal data has been processed. Understanding this helps HR teams avoid treating the DSAR as purely confrontational and focus instead on responding correctly.
For employers particularly concerned about DSARs being used tactically to gain leverage in employment disputes, see our separate guide, “
Subject access requests versus Employment Tribunal disclosure
Subject access requests and Employment Tribunal disclosure are separate processes.
Tribunal disclosure is governed by procedural rules and requires both parties to exchange documents relevant to the issues in dispute, whether or not those documents contain personal data. A DSAR is limited to personal data about the individual. Not every document will need to be disclosed under a DSAR, even if it is relevant to a claim, and some documents containing personal data may never feature in Tribunal proceedings.
The existence of an Employment Tribunal claim does not remove your obligations under data protection legislation. You cannot simply refuse to deal with a DSAR because litigation has started, although certain exemptions may apply in specific circumstances.
First steps when an employee requests “all emails” or submits a DSAR
When a DSAR arrives during an employment dispute, HR and management should:
- Acknowledge the request and note the deadline. In most cases, you have one month to respond, with a possible extension of up to two further months where the request is complex.
- Clarify the scope where appropriate. If the request is unclear or extremely broad, you may ask the employee to clarify what information they are seeking, particularly where you hold large volumes of data. Clarification should focus the response, not delay or discourage the request.
- Identify who needs to be involved. HR, IT, relevant managers and any external legal advisers should be identified early so that personal data is preserved and searches can be coordinated.
- Preserve relevant information. Routine deletion or clean‑up activities that could remove potentially relevant data should be paused once a DSAR has been received.
Early organisation makes it easier to respond within the timeframe and demonstrate compliance if questioned.
Reasonable and proportionate searches: where employers should look
The law requires reasonable and proportionate searches, not limitless trawls through every system.
In practice, employers should:
- focus on systems and custodians likely to hold personal data about the employee, such as HR platforms, email accounts of line managers and investigation files
- take account of how the request is worded, including references to particular departments, managers, projects or time periods
- consider the volume of information involved and the resources available
You are not expected to search every archive for every possible reference, but you should be able to explain your search strategy. Keeping a record of where you searched, which custodians were involved and what decisions were made can be invaluable if your response is later challenged.
What you must provide and what can be redacted or withheld
Employers are required to provide personal data, not complete documents in every case. This allows for:
- redaction, where you remove information that is not the employee’s personal data or that relates to other individuals whose privacy rights must be protected
- withholding certain information where a recognised exemption applies, for example:
- legal professional privilege (confidential communications with lawyers for the purpose of obtaining or giving legal advice)
- some confidential references in specific circumstances
- information that would unfairly disclose personal data about other individuals
- limited management forecasting or negotiations where statutory exemptions apply
The fact that a document is sensitive or commercially confidential does not automatically mean it can be withheld in full. Often, careful redaction allows you to disclose relevant personal data while still protecting privileged or exempt information.
Common mistakes employers make in disputes
When DSARs arise during grievances, disciplinaries or dismissals, employers commonly run into problems by:
- treating the request as an annoyance rather than a legal obligation under UK GDPR
- searching only the HR file and overlooking emails, electronic systems or investigation notes
- applying exemptions too broadly and withholding whole documents instead of redacting
- failing to keep an audit trail of searches and decisions, making it difficult to defend the response if questioned by the ICO or the Tribunal
Avoiding these mistakes is primarily about planning: knowing where data is held, understanding the limits of exemptions and documenting your approach.
The role of the Information Commissioner’s Office
The Information Commissioner’s Office (ICO) is the UK regulator responsible for overseeing compliance with data protection law.
If an employee believes their DSAR has been mishandled, they may complain to the ICO. The regulator can investigate, issue guidance and, in appropriate cases, take formal regulatory action. The ICO does not decide employment disputes or judge whether a dismissal or disciplinary action was fair, but it will look closely at whether you have complied with your data protection obligations.
For employers, a well‑documented and proportionate response can significantly reduce regulatory risk, even where the underlying employment relationship is strained.
When employers should seek legal advice on subject access requests
Employers should seek specialist legal advice on subject access requests whenever a DSAR arises in the context of a grievance, disciplinary process, dismissal or Employment Tribunal claim and the stakes are high. Advice is often particularly important where:
- a grievance, disciplinary process or redundancy exercise involves serious allegations
- whistleblowing or discrimination issues are in play
- dismissal has already occurred or is being contemplated
- senior executives or multiple employees are implicated
- Employment Tribunal proceedings are anticipated or ongoing
- large volumes of emails and electronic records must be reviewed
- privilege, third‑party personal data or sensitive commercial information are involved
Legal advice can help you develop a proportionate search strategy, apply exemptions correctly, protect privilege and ensure your DSAR response supports your wider litigation and HR strategy rather than cutting across it.
Practical guidance for HR and business owners
For HR managers and SME owners, the most effective way to handle DSARs in disputes is to:
- treat the DSAR as a regulatory obligation, not a purely tactical move
- put internal procedures in place for identifying requests and preserving information
- train managers to recognise that emails and messages may later be reviewed as personal data
- involve legal and IT support early where disputes are complex or high‑risk
- use the DSAR process to demonstrate professionalism and transparency, even in difficult circumstances
A well‑managed DSAR response can help de‑escalate tensions, demonstrate good governance and reduce the risk of complaints and satellite disputes.
Frequently Asked Questions: Subject Access Requests
Generally, no. You cannot refuse a valid DSAR simply because a grievance, disciplinary process or Tribunal claim exists. You may withhold or redact particular information where a recognised exemption applies or where a request is manifestly unfounded or excessive. Potentially, yes. Internal emails may need to be disclosed where they contain the employee’s personal data and no exemption applies. Not every internal email will fall within the scope of a DSAR, but emails are often a significant source of personal data in disputes. The usual deadline is one month from receipt of the request. This can be extended by up to a further two months for complex or numerous requests, provided you inform the individual within the initial one‑month period and explain why more time is needed. Yes, if those communications contain personal data about the employee and are held by the employer. DSARs can extend to business use of messaging tools where the organisation controls the data. Late or inadequate responses can lead to complaints to the ICO and may increase the risk of regulatory scrutiny or court applications for compliance. In the context of a grievance or Tribunal claim, mishandling a DSAR can also weaken your position and increase costs. Not in every case. Straightforward DSARs with limited scope can often be handled internally. However, where disputes are complex, involve sensitive information or overlap with litigation, specialist legal advice is usually a sensible investment to protect the business. More than the HR file. Personal data can sit in HR and personnel records, emails and messaging platforms such as Teams and Slack, investigation notes, grievance and disciplinary minutes, and other systems such as time-keeping, access logs and document management platforms. However, subject access requests are concerned with personal data, not every document that mentions the employee. Keep that distinction in mind when deciding what you must actually disclose. Yes, where the request is unclear or extremely broad, particularly if you hold large volumes of data. You can ask the employee to clarify what information they are seeking. Clarification should be used to focus the response, not to delay or discourage the request. Acknowledge the request promptly, note the deadline and involve HR, IT, relevant managers and any legal advisers early so that searches can be coordinated. The law requires reasonable and proportionate searches, not limitless trawls through every system. Focus on the systems and people most likely to hold the employee’s personal data, such as HR platforms, line managers’ email accounts and investigation files, and take account of how the request is worded. Keep a record of where you searched, who was involved and what decisions were made, as this can be invaluable if your response is challenged. You must provide the employee’s personal data, not necessarily complete documents. You can redact information that is not their personal data or that relates to other people, and withhold information covered by a recognised exemption, such as legal professional privilege, some confidential references or limited management forecasting or negotiations. A document being sensitive or commercially confidential does not automatically mean it can be withheld in full, so careful redaction is often the answer.
How the Jonathan Lea Network can help
Subject access requests during employment disputes sit at the intersection of employment law, data protection and litigation strategy. Understanding how these areas interact is essential for avoiding unnecessary legal and commercial risk.
At Jonathan Lea Network, we advise employers across Sussex, London and throughout England and Wales on responding to DSARs arising during grievances, disciplinaries, redundancies and Employment Tribunal claims. We help HR teams and business owners:
- scope requests and design reasonable, proportionate search strategies
- apply exemptions and redactions correctly, protecting privileged and third‑party information
- align DSAR responses with wider grievance, disciplinary and Tribunal processes
- reduce regulatory risk and avoid costly mistakes that can weaken your position in a dispute
We also provide strategic advice where subject access requests are being used tactically alongside grievances, disciplinary processes or Employment Tribunal claims, as discussed in our article “DSARs as a Tactical Weapon: An Employer’s Survival Guide”.
Contact Us
We will respond to most enquiries with an indicative scope and fee estimate and the offer of a complimentary 20-minute discovery video call before sending a more considered formal fee estimate via email.
In limited cases, we may offer a fixed-fee appointment, commonly charged at £750 plus VAT, including document review, a video consultation and an advisory email, as well as an estimate for further work.
Please email wewillhelp@jonathanlea.net or call 01444 708640. We will need an overview of the background and issues, together with significant documents, to provide an indicative scope and fee estimate.
VAT is charged at 20%.
This article is a general overview and is not legal or tax advice. The options available will depend on the LLP agreement and the particular facts of the matter.
This article is intended for general information only, applies to the law at the time of publication, is not specific to the facts of your case and is not intended to be a replacement for legal advice. It is recommended that specific professional advice is sought before relying on any of the information given. © Jonathan Lea Limited.