New ICO Guidance For Employers Responding To Data Subject Access Requests

Today, the UK data protection regulator, the ICO, has published guidance to assist employers in responding to data subject access requests ("DSARs") from current and former employees. DSARs have become the primary tool for employees attempting to gain leverage against employers during a dispute or grievance process: they can be extremely time-consuming and resource intensive for employers to deal with, and it is a difficult balance to strike between upholding employees' right of access under the UK GDPR and applying exemptions from disclosure in an appropriate way.

The new guidance covers issues that often occur when employers try to strike this balance, and notably:

• How the DSAR response process interacts with an ongoing tribunal or grievance process involving the employee making the request – The guidance makes clear that in this situation, the employer must deal with the DSAR, despite the risk that some of the personal data provided could circumvent