Article 15 of the UK General Data Protection Regulation (GDPR) gives an individual the right to make a Subject Access Request (SAR) to obtain personal information held about them by any organisation – including their employer. As you can imagine, SARs are regularly used by aggrieved and disgruntled employees to bolster their evidence in a dispute.
There is no formal process required to make an SAR. It can be made verbally, in writing, or even on social media. There’s also no inherent cost to an individual in making an SAR – the business is not permitted to charge fees for any costs incurred by complying with the request.
Last year, research from the Data Privacy Group showed that SARs are costing UK businesses, on average, between £72,000 and £335,000 each year. Just one individual’s SAR, which needed to be outsourced due to its size, cost one of my clients over £15,000.
How can my business comply with an SAR?
Once a request is received, in most cases, the business must respond with all information held about the individual within one month. However, for SARs deemed “complex”, the timescale for compliance may be extended to three months.
The UK GDPR places a high expectation on organisations to provide information in response to a SAR. Whilst businesses must make (and evidence) “reasonable efforts” to find and retrieve the information, they are not obliged to conduct searches to an unreasonable, or disproportionate extent.
Businesses must therefore balance their weighty legal obligations under the GDPR, and the importance of the individual’s right of access to the information, with a sensible allocation of its resources.
What happens if I don’t or can’t comply?
If a business fails to comply sufficiently with an SAR, the requesting individual can report an infringement of data protection legislation to the Information Commissioner’s Office (ICO). The ICO as the power to investigate, issue warnings, reprimands, and enforcement or penalty notices (fines) for non-compliance.
For serious breaches, the ICO has the power to issue fines up to £17.5 million, or 4% of an organisation’s annual worldwide turnover, whichever is higher. Of course, notices and fines can also carry a negative reputational risk for the organisation.
Why and how are SARs used in disputes?
SARs can be made by an employee to their employer (or ex-employer) at any time, and we have seen a year-on-year increase in the use of SARs by employees in order to obtain information at an early stage upon which to base workplace grievances and/or litigation.
These days, it is very rare for a claimant at an Employment Tribunal (ET) to have not already made an SAR to their employer prior to issuing their claim. For a long-standing employee, an employer could hold a huge amount of data, of many different types, across many different platforms.
For such an employee, an SAR can be a very effective weapon – compliance will cost the business significant management time and expense, not to mention inconvenience, and there are tight timescales to be considered. However, businesses can legitimately limit or refuse to comply with requests which are manifestly unfounded and/or manifestly excessive. This is a lifeline for businesses facing vexatious SARs, where compliance could incur ruinous costs.
Disclosure of relevant documentation is an important stage of any litigation process but, in the employment arena, disclosure usually comes much later in the process and is limited to evidence which is relevant to the claim. SARs, on the other hand, are far wider in scope, requiring access to any information held about the individual.
Potential claimants, therefore, may use an SAR as a “fishing expedition” to glean information which can help them to weigh up the strengths of their prospective claim.
Impact on settlement negotiations
Frequently, information found as part of a search pursuant to the SAR will contain confidential or potentially damaging information that the employer will not wish to disclose.
As the employer knows that even a partial failure to comply could lead to an investigation by the ICO, early settlement negotiations in these circumstances are weighed in favour of the prospective claimant, who can seek a large settlement sum.
The good news
There are steps employers can put in place to manage SARs effectively. These may include:
- Having an SAR policy in place – so that employees can follow a set process to make an SAR, and managers can recognise an SAR when it is made;
- Training management and HR to deal with SARs quickly and effectively;
- Understanding when a request may be deemed “complex” and extend the compliance deadline;
- Understanding the content of the SAR, and when/how to seek clarification;
- Knowing when it can refuse an unreasonable or disproportionate SAR, or limit the scope of the required search) and how this should be managed;
- Understanding what a comprehensive search looks like and how it should be carried out; and
- Understanding which data can be exempted or redacted before information is released in response to an SAR.
Our expert employment lawyer, Jane Smith, has extensive experience advising clients about how to comply with SARs and negotiate the minefield of workplace disputes. If you would like to chat through any employment issues you may be facing, Jane would be happy to hear from you.
This article was first published in the February 2025 edition of our newsletter, Moore Law Monthly. Join our mailing list by signing up on our Linktree here: https://linktr.ee/moorelaw.