Employee DSARs in Ireland: Handling a Subject Access Request During an HR Dispute

Short answer

Treat the request as a valid subject access request, whatever the motive. You have one month from the day your organisation received it, extendable by up to two further months where necessary, taking into account the complexity and number of requests, if you tell the employee within the first month. Search every place their data is held, redact other people’s personal data, apply exemptions only where you can name and explain them, and keep a record. Do not delete or edit anything in the meantime.

Can an employee use a DSAR to get evidence for a dispute?

Yes. The EDPB Guidelines 01/2022 say controllers should assess “what” is requested, not “why” (para. 13). Their first example is a dismissed employee collecting evidence for an unfair dismissal claim: if the request meets the usual requirements, the employer must comply.

The Court of Justice of the EU confirmed in 2023 that a requester does not have to give reasons (Case C-307/22 press release). The Irish DPC has said the right of access does not depend on whether a person is engaged in a court case, and that court discovery is a separate process (DPC blog). An intention to bring further claims does not make a request excessive either (EDPB para. 189).

When does the clock start?

On the day the request reaches your organisation. The DPC’s guide for controllers says the timeline begins on the day the request is received, whichever department receives it. In an HR dispute, the request may go to a line manager or an HR officer, or arrive in a solicitor’s letter. Train managers to pass them on.

Article 12(3) GDPR sets one month, with a possible extension of two further months where necessary because of the complexity and number of requests. You must tell the employee about any extension, with reasons, within the first month. The DPC recommends policies that aim to respond within 15 working days.

Ireland has no statutory stop-the-clock rule. That is a UK rule. The EDPB says time may be suspended while you wait for ID you asked for without undue delay, or for the employee to specify their request where you hold a large quantity of data about them (para. 159). Otherwise, the DPC says, asking for clarification does not stop the clock. The employee does not have to answer, and you must comply anyway. Ask early.

What counts as the employee’s personal data?

It includes:

• the personnel file, contract, payroll and leave records;
• performance reviews, disciplinary records and promotion decisions (EDPB Example 16);
• opinions about the employee, such as investigation notes and managers’ comments. In Nowak v Data Protection Commissioner, the CJEU held that an examiner’s comments on a candidate’s exam answers were the candidate’s personal data (EDPB para. 96);
• internal emails and chat messages that discuss the employee, not only those sent to them. The DPC’s guide says internal material in which the person can be identified, such as internal emails, should be provided, redacted if necessary;
• paper files that form part of a filing system (EDPB para. 98);
• data held for you by processors, such as a payroll or HR system provider (EDPB para. 125).

If the employee limited their request, for example to a disciplinary process, the DPC says you should limit your response to what they asked for. If the request is broad and you hold a lot of data, you can ask them to specify (EDPB para. 35). That request must not be used to narrow or hide anything. If they confirm they want everything, provide everything.

What can you withhold?

Other people’s data. Under Article 15(4), the copy must not adversely affect the rights and freedoms of others. This covers colleagues, witnesses and complainants in a grievance. The DPC warns that removing names may not be enough: references to a role, shift or payroll can still identify someone. Redact those too. Protecting others should not become a refusal to provide anything (DPC: access and portability).

Legal advice and privileged material. The DPC’s guide lists section 162 of the Data Protection Act 2018 (legal advice, privileged communications and court orders) among the restrictions in Irish law. In one DPC case study, a controller withheld a draft letter as privileged but did not clarify the basis for the claim, and the DPC found it had not shown it was entitled to rely on the exemption (DPC case study).

Other restrictions. The DPC’s guide also lists section 60 of the 2018 Act, for example to exercise or defend a legal claim, or for opinions given in confidence.

Whatever you rely on, the DPC says you must identify the exemption, explain why it applies and show that relying on it is necessary and proportionate. Its 2024 Annual Report says redactions and exemptions are for the most part appropriately applied, but complaints stem from insufficient explanations. It suggests documenting exemptions, for example in a table.

Do not delete or edit anything

The EDPB says a controller must not escape its obligation by erasing or modifying personal data in response to an access request (para. 39). If you find data you should have deleted earlier, give access first and delete afterwards (EDPB Example 6). In a live dispute, tell managers not to tidy up files or chats.

A practical sequence for HR

1. Log the date received and acknowledge the request.
2. Verify identity only if you have reasonable doubts. A request from a current employee’s work email is often verifiable from context. See our identity verification guide.
3. Search the HR system, email, chat, shared drives, managers’ notes, paper files and processors.
4. Review and redact, then decide any exemptions and record each one with its reason.
5. Send the copy with the information Article 15(1) requires, through a secure channel, and keep the record.

HR disputes can be contentious. Take advice from your DPO or a solicitor before you withhold material or rely on an exemption.

How SAR Portal helps

• On time. Each case shows its due date and the days left, and the dashboard lists cases that are due soon or overdue. For Irish and other EU cases, the due date stays at one month from receipt and does not pause. The Extend Deadline action allows up to two further months, records it on the case with the reason you give and, if the case has an email address, emails the requester.
• Emails and documents. Upload emails (.eml and .msg), PDFs, Word, Excel and PowerPoint files and images to the case in batches.
• Redaction with review. AI suggests redactions; you review them before release. AI can miss personal data or redact too much, so always check the result.
• Refusals recorded. If you close a case as Rejected or Invalid Request, SAR Portal asks for the refusal ground and, for a national exemption, the exemption you cited.
• A record. Key actions are recorded in an audit log. No user can edit or delete entries.

Frequently asked questions

Can we refuse a DSAR because the employee wants evidence for a claim? Not for that reason. EDPB Guidelines 01/2022 say a controller should not deny access because the data could be used in a dismissal or commercial dispute, and the Court of Justice of the EU has confirmed that a requester does not have to give reasons.

Do we have to give the employee internal emails about them? Yes, where those emails contain the employee’s personal data. Other people’s data in them may need redacting under Article 15(4) GDPR, and some material, such as legal advice, may be covered by an exemption you must identify and explain.

Does the clock stop while we ask the employee to clarify their request? Irish law has no statutory stop-the-clock rule. EDPB guidance says time may be suspended while you wait for ID you asked for without undue delay, or for the employee to specify their request where you hold a large quantity of data about them. Otherwise, the DPC says, asking for clarification does not stop the clock. Ask early.

Can we tidy up or delete files after the request arrives? No. EDPB guidance says a controller must not escape its obligation by erasing or modifying personal data in response to an access request.

Related guides:

• How Long Do You Have to Respond to a DSAR?
• DSAR Identity Verification
• GDPR DSAR Response Checklist

Handle employee requests on time and on the record. Every free trial runs for 14 days on the plan you choose, with up to 500 pages of document processing. No credit card required. Start a free trial or book a demo.

Sources

• GDPR (Regulation (EU) 2016/679) on EUR-Lex: Articles 12 and 15
• EDPB: Guidelines 01/2022 on the right of access, paras. 13, 35, 39, 96 to 98, 125, 159 and 189
• Court of Justice of the EU: Press release on Case C-307/22 (26 October 2023)
• Irish DPC: Subject Access Requests: A Data Controller’s Guide, Access and portability, CCTV, discovery and access requests, Access requests and legally privileged material and Annual Report 2024