There is significant overlap between employee DSARs and document review in employment claims and commercial litigation. Both exercises typically begin in the same place: collecting electronically stored information from IT systems and processing it on an eDisclosure platform. The same documents often appear in both exercises, and the same platforms can handle both. But the legal frameworks are different, and those differences have practical consequences.
What a DSAR actually entitles the data subject to
Under the UK GDPR and the Data Protection Act 2018, a data subject has the right to receive a copy of their personal data, along with supplementary information about how it is being processed. The entitlement is to their personal data, not to documents. That distinction matters more than it might initially appear.
It is also worth being clear about what a DSAR is not. Data subjects, particularly employees who are also claimants in related employment proceedings, sometimes treat the DSAR as a route to early disclosure, asking for information about decision-making or other matters within the business that go beyond their personal data. It is not. A DSAR is not a substitute for the disclosure process in any related employment claim, and responses should be scoped accordingly.
When providing the document is the right answer
If a document relates entirely to the individual — an employment contract, a performance review, a payslip — providing the whole document is usually the most straightforward approach. Any third party personal data or confidential commercial information can be redacted before disclosure. The document is responsive, the personal data and the document are effectively the same thing, and the redaction exercise is manageable.
When providing the document is the wrong answer
Problems arise when the responsive personal data sits inside a wider document that also contains information about other individuals or unrelated confidential business matters. Redacting everything else from that document can be disproportionately time-consuming. It can also make the document look more significant than it is. Heavy redaction draws the eye. A page that is mostly black invites questions.
In these cases, the more efficient and often more appropriate response is to extract the responsive personal data and provide just that. The data subject receives what they are entitled to. The wider document, and everything else in it, does not need to be disclosed at all.
Why this matters in practice
Treating a DSAR like a disclosure exercise — pulling documents and redacting rather than identifying personal data and extracting — tends to increase cost, increase risk, and produce a response that is harder to defend. Understanding the distinction at the outset shapes everything from the review methodology to the platform configuration.
If you are managing a DSAR and want to discuss the right approach, we are happy to help.