Staff subject access requests

The request that arrives with the grievance.

A colleague in a dispute with you has the same right of access as a tenant, and usually a sharper reason to use it. Their data runs through HR systems, their manager's inbox, investigation notes, Teams chats and the emails other people wrote about them. The search is wider, the exemptions are different, and the pack may end up in a tribunal bundle.

Why these are different

The records are conversational. Much of what you hold on a member of staff is other people writing about them: performance notes, grievance investigations, messages between managers. Separating the requester's personal data from the author's opinion, and from third parties named in the same thread, is the whole task.

The exemptions change. Management forecasting and planning, negotiations with the requester, legal professional privilege and confidential references each have their own rules. Applying them inconsistently across a long thread is how packs get challenged.

The timing is adversarial. Tribunal time limits rose from three months to six on 1 October 2026. From January 2027 the unfair dismissal qualifying period drops to six months and the compensation cap goes. Expect more claims and more requests going forwards.

How we handle it

  1. Scope

    The case records who the requester is, what period and systems are in scope, and who else is party to the dispute, so their data is flagged from the start.

  2. Search

    Microsoft 365 is searched by name, aliases, employee number and role, across mailboxes, SharePoint, OneDrive and Teams, with HR and payroll system records added through your connector. The search is logged.

  3. Review

    Each message or document shows the requester's data marked, third parties flagged, and candidate exemptions suggested for your officer to accept or reject. Decisions carry a reason.

  4. Redact and respond

    Burned-in redactions, an independent re-read before release, and an evidence pack showing the search, the decisions and the exemptions applied. HR and the DPO sign off.

What you get

A defensible pack inside the month, built the same way every time, so the version you hand to your solicitor matches the one you gave the requester.

Run one live staff SAR alongside your current process