A Subject Access Request (SAR) rarely arrives at a convenient time. For HR teams already dealing with a difficult employment situation, it can feel like an added complication rather than a routine compliance task. Understanding why SARs so often surface alongside disputes, and how to keep the two matters separate, makes the response go more smoothly.
The SAR That Lands at the Worst Possible Time
There is already a grievance, a disciplinary process, or a dismissal that did not go smoothly, and HR time is at a premium. Then a Subject Access Request arrives, bringing its own timescale and rules regardless of what else is going on. For a smaller business, this can feel out of proportion to the people and hours available.
Sometimes the SAR Is Part of a Much Bigger Dispute
In our experience, some employee and former employee SARs do not arrive out of nowhere. They tend to emerge alongside an existing dispute, whether that is unhappiness about how someone’s employment ended or disagreement with another decision. For the individual, a SAR can become another way of finding out what happened. That does not make the request invalid, but the wider context helps when managing it properly.
Your HR Problem and Your Data Protection Problem Are Not the Same Thing
The employment matter and the SAR are two different things, even though they are connected. Your HR or employment advisers may already be handling the underlying issue, but the SAR creates its own obligations that need to be met correctly and on time. Decisions about scope, disclosure and redaction should be made by someone who understands the data protection regulations clearly, not whoever is handling the employment sid
Why a Straightforward SAR Can Quickly Grow Arms and Legs
At the outset, a SAR can look manageable: a quick search, a handful of files, job done. Then the searching begins in earnest, and email trails involving several people surface far more material than expected some of which touches on other individuals’ personal data and requiring redaction. What started as a contained exercise can grow into a much larger exercise.
The Biggest Mistake Is Treating It as Just a Document Search
The most common misstep is treating a SAR response as a simple search: find the person’s name, gather everything, send it over. A proper response means working out the scope and methodology, what counts as personal data, and what should and should not be disclosed. It means handling redactions carefully and keeping a clear record of decisions and correspondence throughout. Get this wrong and the response can unravel.
Do Not Let the Emotion of the Dispute Drive the Response
Employment disputes are personal, and a SAR landing in the middle of one can feel like another layer of confrontation. But the organisation’s job is to deal with the request objectively, on its own terms. Keeping the SAR process separate from the argument behind it makes for a calmer response, and a much easier one to defend if it is ever challenged.
Knowing When You Need Help
Some organisations have the experience to manage a SAR from start to finish. Others benefit from guidance on scope and approach, an independent review before anything is disclosed, or support throughout the process. What a straightforward SAR needs is very different from what a contested, high-stakes one requires.
Final Thought: The SAR May Not Be the Real Dispute, But It Still Needs to Be Handled Properly
A Subject Access Request is often triggered by something happening elsewhere in the relationship. You cannot control why somebody submits one, but you can control how calmly and properly you respond. Keeping the SAR separate from the emotion of the wider dispute makes it easier to focus on what the data protection obligations require.
If you are not sure how much support you need, CSRB offers three levels of Subject Access Request support, Essential, Professional, and Premium, matched to the complexity of the request in front of you. Visit our Subject Access Request Help & Support page to find out more.