The legal framework
The right to make a data subject access request is established under Article 15 of the UK General Data Protection Regulation (UK GDPR). Any individual whose personal data is held by an organisation has the right to request a copy of that data, along with information about how it is being processed.
The organisation has one month from receipt of the request to respond. Where the request is complex or the volume of data is high, that deadline can be extended by a further two months. The extension must be notified to the requestor within the original one-month period, with reasons. In practice, an extension will almost always be appropriate in a high-volume employee DSAR.
Failure to respond within the deadline, or an inadequate response, exposes the organisation to a complaint to the Information Commissioner’s Office and potential enforcement action.
What employees are entitled to
A data subject access request entitles an individual to receive their personal data. It does not entitle them to copies of entire documents, and it is not a form of early disclosure in the employment claim.
The distinction matters in practice. A document may mention an employee’s name or fall within the scope of issues in an employment claim, without containing any responsive personal data. An email chain discussing a redundancy process, for example, may be relevant for the purposes of disclosure in an employment claim but not responsive to the DSAR.
Where a document does contain the employee’s personal data alongside third-party personal data or commercially confidential information, the employer is not required to provide the document in full. The personal data can be extracted or the document redacted accordingly.
This distinction is often misunderstood, leading to over-disclosure and increased costs.
Why employee DSARs are complex
An initial search of an organisation’s email and messaging systems for an employee’s name will routinely return tens of thousands of documents. Many will not be responsive, but identifying which requires careful human and technological review.
The volume is only part of the challenge. DSARs connected to employment disputes arrive under time pressure, often when HR and in-house legal teams are already managing the underlying claim. Most organisations do not have the specialist tools or capacity to handle a high-volume review in-house. Instructing a full-service law firm to manage the exercise can be difficult to justify commercially against the amounts typically at stake in an employment dispute.
The deadline compounds everything. Unlike the timetable for the underlying claim, the DSAR response deadline is fixed by statute. It does not move to accommodate the complexity of the matter, the availability of the team, or the progress of negotiations.
Scope and proportionality
UK GDPR requires that a DSAR response is proportionate. An organisation is not obliged to conduct an unlimited search of every system that might conceivably hold data relating to the requestor. A reasonable and defensible scope can be agreed with the requestor in advance or notified alongside the response.
In practice, this means defining the custodians whose data will be searched, the date range relevant to the request, and the systems and data sources in scope. A well-scoped exercise produces a response that satisfies the legal obligation without generating unnecessary cost or disclosing material that falls outside it.
Where the volume of potentially responsive data is high, technology-assisted review can identify and prioritise relevant documents far more efficiently than manual review alone. The scope decisions, however, require legal judgement. Getting them right at the outset is the single most effective way to control the cost and complexity of the exercise.
Exemptions
UK GDPR and the Data Protection Act 2018 provide a number of exemptions that may protect certain personal data from disclosure in response to a DSAR. Identifying and applying them correctly is one of the most demanding parts of the exercise. The consequences of getting it wrong run in both directions: over-disclosure hands the requestor material they are not entitled to, while unjustified reliance on an exemption exposes the organisation to challenge.
The exemptions most commonly encountered in employee DSARs include:
Legal professional privilege
Communications between a client and their legal advisers for the purpose of obtaining legal advice, or documents prepared in contemplation of litigation, may be withheld. This is a significant exemption in the employment dispute context, where legal advice on the underlying claim will often feature in the document set.
Management forecasts
Documents containing management forecasts or plans, where disclosure would prejudice the conduct of the business, may be exempt. This can apply to restructuring and redundancy planning documents that feature an employee’s personal data.
Confidential references
References given in confidence by the organisation, for example in connection with a job application, are exempt from disclosure.
Third party personal data
Where a document contains the personal data of individuals other than the requestor, the organisation must balance the requestor’s right of access against the third party’s right to privacy. In practice, this often requires redaction rather than withholding the document entirely.
Automated tools can assist in identifying potentially exempt documents at scale. The judgement calls, however, require legal expertise. Misapplied exemptions are a common source of complaints to the Information Commissioner’s Office.
How we handle your DSAR
Jandr has managed over 25 high-volume employee DSARs. Our process is designed to produce a defensible response efficiently, with minimal disruption to your legal and HR teams.
Scoping
We work with you and your IT team to define the parameters of the exercise: the custodians whose data will be searched, the relevant date range, and the systems in scope. Getting this right at the outset controls cost and establishes the defensibility of the response.
Data collection
Your IT team collects data from the identified systems and transfers it securely to Everlaw. We provide clear instructions and support the process to ensure the collection is complete and defensible.
Intelligent processing
We process and analyse the collected data using Everlaw’s AI functionality to identify potentially responsive documents and reduce the volume requiring human review.
Review and response preparation
Our experienced legal reviewers classify documents, apply exemptions where appropriate, and prepare the response in the form of extracts and redacted documents.
Pre-delivery consultation and quality assurance
Before delivery, the work product is reviewed and signed off by a Jandr principal. We consult with you on judgement calls regarding exemptions and borderline documents, and deliver a draft response with a clear record of decisions taken.
Our DSAR service
Jandr offers a fixed-price, end-to-end DSAR service for employers. Our service is designed to produce a defensible response with minimal disruption to your legal and HR teams, at a cost that is straightforward to justify against the amounts at stake.
We are Cyber Essentials certified. All work is performed on secure Microsoft 365 cloud infrastructure. Everlaw, the platform on which all review work is conducted, is ISO 27001 certified and SOC 2 Type II compliant.
For matters where a fixed fee is not appropriate, we offer competitive hosting and hourly rates with detailed estimates and transparent reporting against agreed budgets.
Talk to us about your DSAR
Whether a DSAR has just landed or you want to understand your options before one does, we are happy to have a no-obligation conversation. Contact Ryan Hockley at DSAR@jandr.legal or call 0800 772 3386. Alternatively, use the form below to arrange a callback or an introductory meeting.