You’ve had a tough conversation with an employee. There’s been tension building, and now they’re off sick, maybe stress related. Before you’ve even had a chance to regroup, an email lands in your inbox: Data Subject Access Request (SAR).
They want everything. Emails. Message threads. Group WhatsApp chats. Notes from the 1-to-1s. Their personnel file. Suddenly, you’re re-reading messages and old email chains thinking: Did we really write that?
This is happening more and more across UK businesses and it’s catching SME leaders off guard.
Data & Insights
- The ICO (Information Commissioner’s Office) has seen a sharp rise in employee-led SARs—especially as part of grievance, disciplinary, ACAS Early Conciliation, or Employment Tribunal claims.
- Responding to a SAR can cost SMEs between £1,200 and £4,000 in admin time alone, depending on volume and complexity (Expert HR, 2024).
- Internal communications revealed through SARs have, in some cases, been used to escalate claims and increase settlement payouts by 30–50% (CIPD case commentary).
Practical Steps to Take
1. Train your leaders on ‘what not to write’
It’s not about policing every word but encouraging leaders to pause before they hit send. If it wouldn’t be comfortable reading in public or at tribunal don’t write it.
2. Audit your messaging channels
Work WhatsApp groups, Slack threads, Teams chats they’re all fair game in a SAR. Make sure you know where your risks are.
3. Responding to SARs? Get expert help early
A sloppy or incomplete response can backfire. Missed deadlines, incorrect redactions, these can lead to ICO complaints, reputational damage, and legal exposure.
4. Embed ‘comms hygiene’
Encourage clear, factual, respectful documentation, especially when dealing with conflict, investigations, or performance concerns.
5. Be proactive, not reactive
Don’t wait until you’re served a tribunal claim. Good habits now prevent chaos and protect your business later.
If the thought of a SAR makes your stomach sink, or you’re already facing one we can help.
Talk to us today about reducing your SAR risk, improving your communication hygiene, and responding smartly when a request comes in.