Employee DSARs: The Records HR Most Often Misses

Short answer

The HR file is rarely the whole answer to an employee DSAR. The records most often missed are the ones around it: manager emails, meeting notes, occupational health referrals, exit interview notes and references. Most of them are mentioned in documents you already have, so you can use those documents to find them.

Employee requests often arrive when something has gone wrong, so the requester may already know what exists. For the wider picture, see our guide to employee DSARs during an HR dispute.

The records to check

1. Notes of one-to-one meetings

Managers often keep them in a notebook, their own folder or a shared document, not the HR system. A later email saying “as we discussed on 10 February” is a sign they exist.

2. Manager and HR emails about the person

Emails between a manager and HR often hold the most candid comments. They are also the likeliest place to find other people’s data, such as a colleague’s absence or health details, which needs careful review before you disclose anything.

3. Occupational health referrals and reports

The referral letter may be on the HR file while the report sits with the provider. If an occupational health provider holds the report on your behalf, ask them for it. If it is health data, check who should review it and how it should be released.

4. Grievance and disciplinary papers

The outcome letter gets filed, but the investigation notes, witness statements and drafts may stay with the investigator. Look for what the outcome letter says was considered. Witness details usually need the most thought under Article 15(4).

5. Exit interview notes and leaver records

An email booking the exit interview shows the meeting happened. The notes are often kept separately, along with the leaver checklist and the record of returned equipment.

6. References

A reference you sent to a new employer can contain the person’s data, and the request for it shows who received it. Recipients are part of the Article 15(1) information too. Local rules on confidential references vary, so check the position where you are.

7. Payroll and benefits held elsewhere

Final pay, a P45 and pension details may sit with an outsourced provider. If that provider processes data for you, the request still falls to you to answer.

8. Messages outside email

Teams or Slack chats, text messages on work phones and shared drives may hold personal data. Include them where your search should reasonably reach them.

A quick way to find what is missing

You do not need to guess which of these exist. Use the check we describe here: read what you have gathered, note every record it mentions, and make sure each one is supplied or has a recorded reason.

A short worked example, using a made-up case:

In the outcome letter: “Having considered the investigation report and the occupational health report of 3 March…”

In a manager’s email: “As we discussed at the 1:1 on 10 February…”

In an HR email: “Exit interview booked for 29 July.”

Three lines point to four records: an investigation report, an occupational health report, the 1:1 notes and the exit interview notes. If any of them is not in your response, you now know where to look.

How SAR Portal helps

On a long employee case, this is where an AI review earns its keep. It reads the documents on the case and lists the records they mention that have no matching file, with the document and the quote for each. Your team confirms what applies and dismisses what does not. It can only list what your documents mention, and a person makes every decision.

It does not replace your search or legal advice. It makes it harder to miss something your own documents point to.

Handling an employee request now? Start a free trial or see how the AI review works.

Sources

• GDPR (Regulation (EU) 2016/679) on EUR-Lex: Articles 12 and 15
• EDPB: Guidelines 01/2022 on the right of access
• Irish DPC: Subject Access Requests: A Data Controller’s Guide