Getting to grips with DSARs: What every HR Professional needs to know

Data Subject Access Requests (DSARs) can cause HR headaches. Employees often use them not just to understand how their data is being used, but also to gather information for ongoing grievances or tribunal claims. While the right to access personal data is a cornerstone of data protection law, for HR, a DSAR can signal the start of a highly sensitive and time-consuming process.

The key is not to panic. A DSAR doesn’t mean turning over every document ever created. What it does mean is reviewing any data that personally identifies the requester – including emails, notes, and messages – and making a lawful and timely disclosure. Here are some top tips:

1. Read the request carefully. Work out what’s being asked and where that information sits – think emails, HR files, messaging platforms. Loop in IT early if you need help searching systems. Identify who in your team can help, especially if the request is large or involves multiple departments.
2. You only have one month to respond but this can be extended by up to two more months if the request is particularly complex or repetitive. Just be sure to notify the employee in writing and explain why.
3. Advance preparation pays off. Establish a consistent internal process and train relevant staff on how to handle DSARs. If your team is already equipped to run targeted searches and assess exemptions, your response time and stress levels will improve significantly.
4. Not everything has to be disclosed. There are exemptions, but they’re narrowly applied. These include legally privileged documents, information relating to confidential negotiations, and material involving other people where you can’t obtain their consent for disclosure and redaction isn’t possible. Always document your reasoning if you rely on an exemption – especially in contentious cases.
5. Be careful about consistency. Treating one DSAR differently just because it’s linked to a discrimination complaint, for example, could open the door to victimisation claims.

Handled properly, a DSAR is manageable. Mishandled, it can escalate into a legal and reputational issue. A cool head, clear process, and early planning will go a long way.