Subject Access Requests and Employment Tribunals: What UK Employers Need to Know

A subject access request arriving during an employment tribunal claim is one of the most stressful scenarios for UK employers. The temptation is to treat it as litigation tactics — but ignoring or delaying a SAR during tribunal proceedings carries more risk than responding to it.

This guide covers what employers must do when a SAR and a tribunal claim overlap, where the exemptions genuinely apply, and the consequences of getting it wrong.

This guide covers SARs in the context of UK employment tribunals. It is not legal advice. For SARs linked to active litigation, seek specialist legal counsel before applying exemptions.

You must respond — regardless of the tribunal

The right of access under UK GDPR cannot generally be waived by contractual agreement, including settlement agreements. An ongoing tribunal claim does not pause, reduce, or modify your obligations under UK GDPR Article 15. The ICO's employer Q&A is explicit: you must comply with a SAR even if there are ongoing proceedings.

Common misconceptions:

• "The SAR is just a fishing expedition" — irrelevant. The requester's motivation does not affect your obligation to respond.
• "The tribunal disclosure process will cover this" — no. SAR rights and tribunal disclosure are separate legal obligations. You must comply with both, even where the data overlaps.
• "We can wait until the tribunal is resolved" — no. The one-month deadline applies regardless. Use the SAR deadline calculator to track it.

Why SARs spike during tribunal disputes

Employees and their solicitors use SARs strategically because:

• SARs are broader than tribunal disclosure. Tribunal disclosure is limited to documents relevant to the issues in dispute. A SAR covers all personal data — including internal emails, performance notes, and management discussions the employee would never see through disclosure alone.
• SARs are free. No court application needed, no fee, no threshold test.
• SARs have teeth. If you fail to respond, the employee can complain to the ICO independently of the tribunal — creating a second front.
• SARs reveal your record-keeping. A poorly handled SAR response can demonstrate to the tribunal that your data management is chaotic, undermining your credibility on other issues.

Where exemptions genuinely apply

The DPA 2018 Schedule 2, Part 4 exemptions are most heavily tested during tribunal-related SARs. Apply them carefully:

Legal professional privilege (paragraph 19) — the most commonly used exemption in tribunal SARs. Covers:

• Advice from your solicitor about the tribunal claim
• Litigation strategy documents created for the dominant purpose of the proceedings
• Correspondence between you and your solicitor about the case

Does NOT cover:

• Internal HR discussions that mention the solicitor's involvement but don't reveal advice content
• Investigation notes created before litigation was contemplated
• The fact that you instructed solicitors (you can acknowledge this; withhold the content)

Negotiations (paragraph 23) — covers your settlement intentions. If your internal notes say "we'll offer up to £20K but start at £10K," that strategy is exempt. The existence of negotiations is not.

Management forecasts (paragraph 22) — relevant if the employee's SAR would reveal restructuring plans not yet announced. Once announced, the exemption falls away.

Use the SAR exemption checker for a guided walkthrough. For detailed exemption guidance, see SAR Exemptions Explained.

What happens if you get it wrong

ICO complaint. The employee files a complaint with the ICO — separately from the tribunal. The ICO investigates whether your response was complete, timely, and whether exemptions were correctly applied. If not: reprimand, enforcement notice, or penalty.

Adverse inferences in the tribunal. A tribunal cannot directly enforce SAR compliance, but it can draw adverse inferences from your failure. If you withheld data that turns out to be relevant to the case, the tribunal may infer that the withheld data would have supported the employee's claim.

Costs orders. In extreme cases, unreasonable behaviour in relation to data can contribute to a costs order against you.

Credibility damage. A late, incomplete, or incorrectly redacted SAR response signals to the tribunal that your HR processes are unreliable — which affects how the tribunal views your evidence on every other issue in the case.

Practical steps for tribunal-related SARs

1. Separate the SAR from the tribunal. Assign the SAR response to someone not directly involved in the tribunal litigation. This reduces the risk of the response being influenced by litigation strategy.

2. Get legal advice on exemptions early. Legal privilege is the exemption most likely to apply — and the most likely to be incorrectly applied. Do not attempt privilege assessments without legal input if the claim involves complex issues.

3. Document everything. For each exemption applied, record: the specific document, the exemption relied on, and the reasoning. This is your defence if the ICO investigates.

4. Respond on time. A late response during tribunal proceedings looks deliberate. Track the deadline from day one — see Subject Access Request Time Limit UK.

5. Consider the extension. If the SAR is genuinely complex (multiple systems, extensive privilege review), use the two-month extension — but notify within the first month with reasons.

For the complete SAR response process, see How to Respond to a Subject Access Request from an Employee. For response templates, see Free Subject Access Request Templates.

Frequently asked questions

Can I refuse a SAR because it is motivated by a tribunal claim? No. The requester's motivation does not affect your obligation. Even if the SAR is clearly strategic, you must respond.

Does tribunal disclosure replace the SAR obligation? No. They are separate legal processes. You must comply with both.

Can a SAR be used to obtain "without prejudice" correspondence? Without prejudice communications are covered by the negotiations exemption (paragraph 23) — but only your intentions and strategy, not the existence of the negotiation or its factual content.

Sources

• ICO — Subject access request Q&As for employers
• UK GDPR — Article 15 (right of access)
• Data Protection Act 2018 — Schedule 2, Part 4 (exemptions)
• ICO — Right of access (subject access) guidance