Handling Data Subject Access Requests From Employees

Our team of experts in data protection law advise employers on handling Data Subject Access Requests (sometimes referred to as a SAR or DSAR), making sure they are transparent and compliant with the regulations.

Responding to a SAR from an employee

All employees have the right to make a subject access request to enable them to see what personal data employers process about them. It is relatively easily for the employee but for an organisation to respond it can take a significant amount of time and resources. Furthermore, should an individual be dissatisfied with how you have handled their request, then that individual can complain to the Information Commissioner’s Office (ICO.

The team at Kuits specialises in supporting employers to comply with data protection laws and provide comprehensive guidance on managing SARs from an employer’s perspective. This involves helping you comply with your data protection obligations, whilst also protecting your organisation. Our team has significant experience in dealing with the ICO and ensure that the client’s interests are protected.

We help clients concentrate their efforts by making sure that, when faced with a SAR, they only search for what’s reasonable and fair while also applying disclosure exemptions which means they are not revealing anything unnecessary or unlawfully sharing personal data about other individuals when complying with the SAR.

Tips for responding to a SAR
  1. Recognise the Subject Access Request
  2. Identify the individual making the request
  3. Establish timeframes to respond
  4. Agree the scope and search terms
  5. Consider the extent of the search on your systems
  6. Identify data to be disclosed
  7. Consider third party personal data
  8. Identify whether any exemptions apply
  9. Securely disclose the personal data
  10. Keep a record of decisions made
Implications and penalties for non-compliance with GDPR

If an employer fails to comply with a SAR, the ICO can take enforcement action against them for their failure to comply with data protection legislation. This can range from being required to take corrective action following what can be an invasive investigation, to the imposition of significant penalties. Organisations found in violation may face fines of up to £17.5 million or 4% of their global annual turnover, whichever is higher.

Our highly experienced team can assist clients in meeting their data protection obligations to safeguard their reputation and avoid these consequences.


bringing a tribunal claim

Bringing an Employment Tribunal Claim

Disputes with your employer can be disruptive....

Defending an Employment Tribunal Claim

We are experienced in defending employment tribunal claims. ...

For Businesses

Our team has a wealth of experience in advising public and private companies...

For Individuals

We have a wealth of experience in handling employment matters for employees....

General Data Protection Regulation (GDPR)

Our team can help create a GDPR action plan....

Redundancy Procedures and Consultations

We are experienced in redundancy and restructuring procedures....

Retainer Services

For companies that need ongoing advice we offer a retainer service. ...

Settlement Agreement Solicitors Manchester

We have extensive experience of advising on settlement agreements....

Teaching Regulation Agency

Teaching Regulation Agency (TRA) Lawyers

We can assist you in successfully defending a prohibition order....


Training Workshops

We provide training workshops for managers and HR professionals. ...

Kuits FSQS registered
Kuits good employment supporter