International Day for Universal Access to Information: A reminder on data subject access requests for employers

On International Day for Universal Access to Information, it seems appropriate to remind employers of some key lessons when dealing with data subject access requests (DSARs).

It is increasingly common for workers to submit a DSAR at a point of conflict (during a grievance or disciplinary process) or as a precursor to an Employment Tribunal claim. Our recommendations are:

• Know how to spot a DSAR: Some DSARs will be obvious and refer to themselves as such. Others may not explicitly frame themselves as DSARs, but due to their content may in fact be a DSAR. Ensure that managers and HR are trained in spotting a request that might be a DSAR and seek advice if they are unsure

• Have a process in place for dealing with DSARs: DSARs can be complex and time-consuming to deal with. Some large employers have their own internal teams who deal with them. Other employers seek external expert assistance. The tasks of data retrieval, analysis and redaction of third-party data often require dedicated support, so it is important that there is a plan and process in place

• Have a complaints procedure in place: Since 19 June 2026, the Data (Use and Access) Act 2025 has required organisations to have a formal process in place for handling data protection complaints (including complaints about how they have handled DSARs)

Organisations must:

• Provide a way for individuals to raise data protection complaints directly with them

• Acknowledge complaints within 30 days of receipt

• Take appropriate steps to investigate and respond without undue delay

• Provide an outcome to the complainant, explaining what action has been taken or why the organisation believes it has complied with the law

There does not need to be a single complaints channel. However, importantly, individuals are not required to use a specific process and may raise complaints with any employee or via informal channels. This means that spotting complaints will be key: for example, a complaint about compliance with a DSAR sent in an email to HR or a manager will still need to follow the formal process, even if it was not submitted through formal channels.