Subject access requests (‘SARs’) are dealt with under Article 15 of the GDPR which permits data subjects to find out if their personal data is being processed; and, if so, to obtain personal data via a SAR. However, difficulties can arise for employers when data requested contains other employees’ personal data.

In the case of a SAR relating to a grievance or disciplinary matter, it is likely that other individuals will be referred to, or even be identifiable from the information. Therefore, it is prudent for employers to consider whether any exemptions under the DPA 2018 apply which would prevent disclosure of such personal data. Although there is no specific exemption for data relating to ongoing disciplinary or grievance processes, employers should consider whether the general exemptions e.g. legal professional privilege or intentions relating to negotiations could apply.

If it is not plausible to rely on one of the exemptions, employers must then consider whether:

(a)  The other individual has consented to the disclosure of the information to the employee; or

(b)  It is reasonable to disclose the information without the other individual consenting.

Employers could also consider redacting out information relating to other employees. For example, if a witness statement forms part of the grievance/disciplinary procedures, the statement could be edited to prevent the witness being identifiable or a summary of the information could be prepared. Ultimately, an employer must decide whether it would be reasonable in the circumstances to disclose the documentation.