Staff subject access requests during grievances and tribunal claims

Why these requests are different

Staff and former staff have the same right of access as tenants. The difference is context. A staff request usually arrives during a grievance, a disciplinary, a redundancy or after a dismissal, often drafted with an adviser, and the response may be read line by line in an employment tribunal.

Under the Employment Rights Act 2025, most tribunal claims about acts on or after 1 October 2026 can be brought within six months rather than three. Expect requests from leavers to keep arriving for longer after they go.

Where to search

Your search must be reasonable and proportionate. For a staff request that usually means:

• the HR system and personnel file, including absence, pay and performance records
• the inboxes of their line manager, HR adviser and anyone who investigated a grievance or disciplinary
• Teams chats and channels, OneDrive and SharePoint where they are discussed
• investigation notes, interview records and outcome letters
• occupational health referrals and reports
• building access, phone and system logs, if they are in scope of what was asked

Use their full name, first name, nicknames, initials, payroll number and email address as search terms. Messages between managers calling someone "J" or "the new starter" are still their personal data if they are identifiable. Record every location and term you used.

Opinions about the employee

Comments about the requester by managers and colleagues, including in informal chats, are the requester's personal data. They are often the information the requester most wants and the information people least expect to disclose. They are not exempt because they are frank or embarrassing.

What can be weighed is the information about the colleague who wrote them. Their name and opinions about others fall under the third-party rules. Our redaction guide sets out the factors.

Exemptions that come up

• Legal professional privilege: advice from your employment lawyers, and documents prepared for the tribunal claim.
• Negotiations: your intentions in settlement discussions with the requester, where disclosure would prejudice them.
• Management forecasting: restructuring or succession planning that would be prejudiced by disclosure.
• Confidential references: references given in confidence for employment purposes.
• Health information: occupational health reports have additional rules in the Act. Take advice before withholding.

Each exemption applies to specific information. Record which one you relied on, for which item, and why.

Subject access and tribunal disclosure

A subject access request and tribunal disclosure are separate regimes with different rules. A pending claim does not suspend the request, and the requester does not have to tell you why they want the data. Answer the request on its own timetable, keep the responses consistent, and tell your legal advisers what you have disclosed.

Be careful about documents created after the request arrives. They may also be in scope if they exist when you respond, so the way managers write about the case from that point matters.

Practical steps

1. Log the request the day it arrives and set the deadline.
2. Tell the people whose mailboxes you will search, and ask them not to delete anything relevant.
3. Agree the date range and search terms, and write them down.
4. Separate privileged material early, with your legal adviser.
5. Review colleagues' information item by item and record the reasons.
6. Check the final redacted files before release.

Questions

Sources

• ICO: Subject access request Q and As for employers
• Data Protection Act 2018, Schedule 2
• Employment Rights Act 2025