A disciplinary or grievance process or investigation is underway. Emotions are running high, deadlines are approaching, and then an employee submits a Subject Access Request (SAR). Or perhaps they send an email claiming you have breached their data protection rights.
For many social sector leaders, trustees and managers, this can feel like a crisis. In reality, it is a common situation and, if handled correctly, entirely manageable.
The key is understanding that you may now be dealing with two separate processes: a Subject Access Request and, potentially, a data protection complaint under the Data (Use and Access) Act 2025 (DUAA).
In this blog, we’ll explain what to do, when to do it, and how to manage both workstreams without derailing the underlying disciplinary or grievance process.
If you’re currently managing a formal process and receive a SAR, our expert HR Consultants works with charities and social enterprises across the UK to navigate complex employee relations matters.
Why Subject Access Requests are common during a disciplinary or grievance process
It is increasingly common for employees to submit a Subject Access Request when a disciplinary or grievance process begins.
In most cases, the individual wants to:
- Understand what information the employer holds about them
- Review evidence being relied upon in the disciplinary or grievance process
- Check what has been said about them internally.
- Prepare for a disciplinary or grievance hearing, appeal, or potential Employment Tribunal claim.
Importantly, the existence of a SAR should not automatically be viewed as hostile or adversarial. Employees have a legal right to access their personal data, and many requests are submitted simply because individuals want clarity about what information exists.
Employers who react defensively, or treat the request as a challenge, could create more risk than the request itself.
What is a data protection complaint, and how do you know one has been made?
Since 19 June 2026, individuals have had a statutory right under the Data (Use and Access) Act 2025 to complain directly to an organisation about suspected breaches of their data protection rights.
Whilst a SAR asks what personal data you hold about an individual, a data protection complaint alleges that the organisation has done something wrong, such as:
- Processing personal data unlawfully.
- Keeping inaccurate information.
- Failing to protect information adequately.
- Refusing to comply with a data subject right.
- Sharing data inappropriately.
It’s important to understand that a data protection complaint does not need to be labelled as a “formal data protection complaint” to count. It can be raised verbally, by email, via a grievance, or even through social media.
Employers should be alert to indications that an employee is challenging how their information has been handled.
Phrases that may signal a data protection complaint
Be aware of statements such as:
- “I don’t think you should be holding this information about me.”
- “This breaches my data protection rights.”
- “You have shared my information without permission.”
- “You are processing my data unlawfully.”
- “I want to complain about how you are using my personal data.”
The SAR time limit and process for handling a data protection complaint
One of the most common concerns employers have is meeting the relevant deadlines.
For a Subject Access Request, the process should generally be:
- Verify the individual’s identity where necessary
- Log the date the request was received
- Clarify the scope, if the request is particularly broad
- Conduct reasonable and proportionate searches of relevant systems
- Review information for applicable exemptions
- Redact third-party personal data where appropriate
- Respond within one calendar month.
The response period can be extended by up to two additional months if the request is complex, but the individual must be informed of the extension and the reasons for it within the original one-month period.
For a data protection complaint, employers should:
- Record and acknowledge the complaint (within 30 days)
- Investigate the specific concern raised
- Keep records of actions taken
- Provide a substantive response without undue delay.
The critical point is that these should be treated as separate workflows with separate tracking.
Suggested SAR handling checklist
A simple SAR checklist for managers or HR teams handling a SAR:
✅ Log the request and deadline
✅ Verify identity if needed
✅ Clarify scope where appropriate
✅ Search relevant systems and records
✅ Apply exemptions and redact third-party information
✅ Issue the response within the statutory timeframe
This checklist can help ensure compliance while maintaining progress on the underlying employee relations process.
Should the disciplinary, grievance or investigation be paused?
In most cases, no. There is no blanket rule requiring employers to pause a disciplinary or grievance process simply because a SAR has been submitted.
In practice, the best approach is usually to run both processes in parallel. This means:
- Continuing the disciplinary or grievance timetable
- Processing the SAR separately
- Avoiding unnecessary delay
- Keeping clear records of decisions and reasoning.
There may be circumstances where a short pause is appropriate. For example, if information being gathered for the SAR is genuinely required for the employee to prepare for an imminent hearing.
However, neither employers nor employees should use SARs as a mechanism to stall proceedings.
The key question is always whether continuing the process remains fair and reasonable in the circumstances.
How to handle a data protection complaint during a disciplinary or grievance process
A common mistake is attempting to fold a data protection complaint into the disciplinary or grievance process; this is rarely advisable. Instead:
- Allocate ownership of the complaint separately
- Where possible, use someone independent from the disciplinary or grievance process
- Acknowledge the complaint promptly
- Explain anticipated timescale
- Keep the investigation distinct from the employee relations matter.
Most importantly, avoid creating any impression that the outcome of the data protection complaint is linked to the outcome of the disciplinary or grievance investigation.
Good record keeping is essential. If the complaint later reaches the Information Commissioner’s Office (ICO) or forms part of tribunal proceedings, a clear audit trail will be invaluable.
Can an employee use a SAR to obtain investigation notes?
Generally, yes, as investigation notes, meeting records, interview summaries and correspondence may contain the employee’s personal data and therefore fall within the scope of a SAR.
This is one of the most common reasons employees submit requests during disciplinary or grievance processes.
However, disclosure is not automatic or unrestricted. Before releasing documents, employers should review them carefully and consider:
- Whether they contain third-party personal data
- Whether an exemption applies
- Whether redactions are required.
Employers should assume that investigation notes are likely to be requested and ensure records are professional, factual and appropriate from the outset.
SAR exemptions under UK GDPR: What information can be withheld?
While employees have broad rights of access, these rights are not unlimited.
Several exemptions may permit information to be withheld.
Exemptions at a glance
| Exemption | What It Covers |
| Legal professional privilege | Confidential communications with legal advisers relating to the matter |
| Third-party personal data | Information identifying other individuals where disclosure would be inappropriate |
| Management planning | Certain forecasting and planning information where disclosure could prejudice the organisation |
| Confidential references | References given or intended to be given concerning the employee |
Each exemption must be assessed carefully on its own facts.
For example, the presence of third-party information does not automatically justify withholding an entire document. In many cases, employers can redact identifying details while still providing the relevant information.
How should employers handle witness statements in a SAR?
Witness statements can be particularly challenging because they often contain personal data relating to both the employee and the witness.
Employers have discretion, but should consider:
- What the witness was told when providing the statement – were they told it might be disclosed?
- Whether the witness expected confidentiality
- Whether the witness has consented to disclosure
- Whether it would be reasonable to reveal their identity.
In many cases, redacting identifying details may strike an appropriate balance between protecting the witness and providing the employee with access to their personal data.
Employers should avoid assuming that witness statements can automatically be withheld in full. Equally, disclosure of identities should not occur without careful consideration of the circumstances.
Information that doesn’t need to be included
Not every document connected to a disciplinary or grievance process must be disclosed.
Information that may not need to be provided includes:
- Internal commentary that does not constitute the employee’s personal data
- Information already supplied in response to an earlier SAR
- Documents covered by a recognised exemption
- Fully anonymised information where the individual can no longer be identified.
Each SAR should be assessed on its own facts and the rationale for any exclusions should be documented. Further guidance can be found on the Information Commissioner’s website.
Get HR advice on SARs and data protection complaints and their impact on formal processes
Managing a disciplinary or grievance process is challenging enough without simultaneously navigating a SAR or data protection complaint.
The good news is that these situations are usually manageable when approached systematically. By treating a SAR and a data protection complaint as separate processes, maintaining clear records and applying exemptions carefully, employers can protect both procedural fairness and data protection compliance.
If you’re dealing with a live case or want reassurance that your procedures are fit for purpose before a problem arises, contact us for support.
You may also find it helpful to ensure your policies and procedures around data protection remain up to date.
This blog post provides general guidance only and does not constitute legal advice. Organisations facing a live disciplinary, grievance, SAR or data protection complaint should seek advice specific to their circumstances.
Frequently Asked Questions
What is the time limit for responding to a Subject Access Request?
Employers must usually respond within one calendar month of receiving the request. This can be extended by up to two further months if the request is complex, provided the individual is informed of the extension and the reasons for it within the original deadline.
Can an employer refuse a Subject Access Request?
Only in limited circumstances. Requests that are manifestly unfounded or excessive may be refused, and certain exemptions may apply. The existence of an ongoing disciplinary or grievance process is not, by itself, a valid reason to refuse a SAR.
What are the exemptions to a Subject Access Request under UK GDPR?
Common exemptions include legal professional privilege, third-party personal data, management planning information and confidential references. Each exemption must be considered individually rather than applied as a blanket refusal.
How does UK GDPR apply to a Subject Access Request during a disciplinary or grievance process?
Employees retain the same rights to access their personal data during a disciplinary or grievance process, or investigation as at any other time. The formal process or investigation do not remove those rights, although exemptions may affect what information can ultimately be disclosed.
Should a disciplinary or grievance process be paused whilst a Subject Access Request is being handled?
Not automatically. In most cases, employers can continue the disciplinary or grievance process while managing the SAR separately. A short pause may be appropriate in specific circumstances where fairness requires it, but this should be considered on a case-by-case basis.
