Employee Dsar Response

Employee DSAR Response

Overview

Employee Data Subject Access Requests (DSARs) are among the most complex and resource-intensive DSARs that organisations receive. Unlike customer DSARs, which typically involve a defined set of transactional data, employee DSARs can span the entire employment lifecycle and encompass data held across dozens of systems: HR records, emails (sent, received, and about the employee), CCTV footage, access control logs, telephone recordings, performance reviews, investigation files, grievance records, occupational health reports, training records, payroll data, expense claims, monitoring data, and informal notes and communications between managers. The scope, combined with the need to redact third-party personal data and assess legal privilege, makes employee DSARs a distinct operational and legal challenge.

This skill provides a structured response process, a comprehensive data source inventory, and decision frameworks for the exemptions and redactions most commonly encountered in employee DSARs.

Art. 15 — Right of Access

What the Employee Is Entitled To

Under Art. 15(1), the employee has the right to obtain from the controller:

Art. 15(3) — Format

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested, the controller may charge a reasonable fee based on administrative costs. Where the request is made by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested.

Art. 15(4) — Third-Party Rights

"The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others."

This provision is the legal basis for redacting third-party personal data from DSAR disclosures.

Employee DSAR Data Source Inventory

Comprehensive Search Scope

The following data sources must be searched when processing an employee DSAR:

Search Strategy

Not every data source must be searched exhaustively for every DSAR. The search scope should be proportionate to:

1. The request scope: If the employee has specified particular data they are seeking (e.g., "I request copies of all performance reviews from 2022-2025"), the search can be focused accordingly
2. The employment context: A current employee's DSAR typically spans the entire employment period; a former employee's data may have been partially deleted under retention policies
3. Reasonableness: Art. 12(5) allows refusal of requests that are "manifestly unfounded or excessive" — a request for "every email I was ever mentioned in" across a 20-year career may be excessive, but the bar for refusal is high

Response Timeline

Standard Timeline — Art. 12(3)

• One calendar month from receipt of the DSAR
• The month runs from the day after receipt (if received on 15 March, the deadline is 15 April)
• If the deadline falls on a weekend or public holiday, the deadline extends to the next working day (ICO guidance)

Extension — Art. 12(3)

• The deadline may be extended by two further months where the request is complex or the controller has received numerous requests from the same individual
• The controller must inform the employee of the extension within one month of receipt, together with the reasons for the delay
• Employee DSARs frequently justify extension due to the volume of data sources, redaction complexity, and legal privilege review

Employee DSAR Response Process

Day 1: Receipt and Acknowledgment

1. Log the DSAR in the central DSAR register with a unique reference number
2. Verify the employee's identity (for current employees, identity is typically confirmed through the employment relationship; for former employees, additional verification may be needed)
3. Send acknowledgment confirming receipt and expected response date
4. Assign a DSAR coordinator (typically from the privacy/DPO team)

Days 2-5: Scoping

1. Review the request to determine scope — is the request for all data, or specific categories?
2. If the request is unclear, contact the employee to clarify scope (the clarification period does not pause the clock unless the request genuinely cannot be processed without clarification — ICO guidance)
3. Map the request to the data source inventory
4. Identify custodians for each data source and issue collection instructions
5. Assess whether an extension is likely needed; if so, notify the employee within the first month

Days 5-20: Collection

1. Each data custodian searches their system(s) and exports relevant data
2. Email searches: search for the employee's name and email address in mailboxes of direct managers, HR business partners, and relevant stakeholders
3. CCTV: identify time periods and locations where footage may contain the employee
4. Paper files: retrieve physical personnel file and any archived records
5. All collected data must be logged with source, custodian, and date of extraction

Days 15-25: Review and Redaction

1. Review all collected data for personal data of the requesting employee
2. Identify and redact third-party personal data (see redaction framework below)
3. Identify and withhold legally privileged material (see privilege framework below)
4. Identify and assess any other applicable exemptions
5. Compile the disclosure package

Days 25-30: Quality Check and Dispatch

1. DPO or senior privacy officer reviews the disclosure package for completeness and proper redaction
2. Prepare a covering letter explaining: scope of search, any exemptions applied, the employee's right to complain to the supervisory authority
3. Deliver the disclosure to the employee via secure channel (encrypted email, secure portal, or registered post)

Redaction Framework

Third-Party Personal Data — Art. 15(4)

The right of access must not adversely affect the rights and freedoms of others. This requires redaction of third-party personal data unless:

• The third party has consented to disclosure, or
• It is reasonable in all circumstances to disclose without consent

Redaction decision matrix:

Practical Redaction Technique

• Use permanent redaction (not highlight or track-changes redaction)
• Replace names with "Person A," "Person B" consistently throughout the disclosure
• Redact email addresses, phone numbers, and job titles that could identify third parties
• Do not redact the requesting employee's own data or information they already know

Legal Privilege Exemption