Employees and former employees have data rights, but employment files can contain complex third-party, privilege and management information.
Employers process large amounts of personal data: HR files, payroll, absence records, performance notes, emails, chat messages, access logs, monitoring data and investigation material. A SAR can reach personal data across these systems, subject to exemptions and third-party rights.
Employment disputes often generate overbroad expectations in both directions: an employer cannot limit a SAR to the HR folder simply because that is convenient, but an employee is not automatically entitled to every business document mentioning the dispute.
Key points
- Manager emails and messages can contain employee personal data.
- Confidential references, legal privilege and management information can raise exemptions.
- Monitoring must still comply with lawfulness, fairness, transparency and proportionality.
- Accuracy rights can apply to factual HR records.
Emails and workplace messaging
Searches should be reasonable and proportionate. Naming likely custodians, teams and date ranges can help. Personal data can include opinions about performance and decisions, not only obvious identifiers.
Investigations and grievances
Investigation files may contain third-party witness information and privileged legal advice. The employer should assess each category rather than withholding the entire file by default.
Monitoring and access logs
CCTV, device logs, location data, call monitoring and productivity tools involve separate transparency and proportionality questions. A SAR can provide access to personal data but does not by itself determine whether monitoring was lawful.
In practice
- Use specific custodians and dates when challenging missing employment data.
- Keep grievance/disciplinary timelines separate from SAR deadlines.
- If litigation is active, expect privilege and legal-claim issues to require careful analysis.
What to do
A practical next-step plan
- Define the employment issue and period.
- Make/clarify the SAR.
- Inventory the response by system/category.
- Challenge missing likely repositories.
- Use rectification for factual inaccuracies separately.
Common traps
Things that often confuse the issue
- A SAR is not civil disclosure and should not be used as if it were.
- Legal privilege can legitimately protect some communications.
- An employer should not delete records merely because a SAR was made, but ordinary lawful retention processes still matter.
Evidence worth keeping
Preserve the distinction between access and litigation disclosure.
A SAR is not a substitute for employment tribunal disclosure, and litigation disclosure is not a reason to ignore a valid SAR. Different tests and exemptions apply. If a dispute is already live, keep a clear record of which documents were requested under which process and do not assume one route automatically provides everything available under the other.
Practical record.
Keep privacy notices, monitoring policies, screenshots, HR records, SAR correspondence, grievance material and any explanation of the purpose/lawful basis. If employment deadlines may be running, do not wait for a data-protection process before taking employment-law advice.
Use the correct right for the problem.
| Problem | Potential route |
|---|---|
| Need copies of emails, notes or HR data about you | Subject access request, subject to exemptions/third-party rights. |
| Factual error in HR record | Rectification; consider restriction while checked. |
| Disputed evaluative comment | Ask that context/correction be recorded; an accurately recorded opinion is not automatically “inaccurate”. |
| Object to particular processing | Right to object where the relevant legal conditions are met. |
| Monitoring concern | Data-protection complaint, potentially alongside employment grievance. |
Employment-law and data-protection routes can run together. A grievance does not replace a SAR, and a data complaint does not decide whether dismissal, discrimination or disciplinary action was lawful.
Monitoring must be analysed separately from ordinary HR administration.
Email, internet, device, CCTV, location and productivity monitoring can be intrusive. Ask what purpose the employer is pursuing, what information is collected, whether workers were told, how long it is kept, who receives it and whether a less intrusive method would achieve the same purpose. Secret monitoring requires particularly careful justification and is not made lawful merely because equipment belongs to the employer.
An employer does not own unrestricted rights over worker information.
Employment creates legitimate reasons to process substantial personal data, but the employer still needs a lawful basis, purpose limitation, data minimisation, accuracy, retention controls and security. Some workforce information is special-category data or criminal-offence data and needs additional legal conditions. “It is an HR record” is not a complete answer to why particular processing is lawful.
Official sources
Check the rules behind this guide
ConsumerWise explains these materials in plain English. Check the current official source where a deadline, rule about what the body can deal with or legal requirement may have changed.