HR Articles

Under the General Data Protection Regulation (GDPR), in both the EU and UK versions, employees have the right to request access to their personal data from their employer called a Data Subject Access Request (DSAR).   

A controller is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing of personal data.

On 10 May 2022, Prince Charles confirmed, as set out in the Queen’s Speech, that there would be a new data protection regime in the UK, with some measures extending and applying to England and Wales only. 

For organisations that transfer personal data from the UK to other jurisdictions, new data sharing agreements are now in force. 

The ICO’s International Data Transfer Agreement (IDTA) is another step along the way to greater clarity, after the upheavals of Brexit and the landmark European privacy ruling, Schrems II.  

Sometimes, data protection can seem like unhelpful red tape. At other times, it is critical to cultivating a trustworthy reputation. Either way, organisations face data protection challenges in various spheres – including employment and commercial practice.

Technology has placed a major role in ensuring the survival of businesses across the country over the past 18 months. Companies with strong IT capabilities will have been better placed to weather the changes brought on by the pandemic to the way we work, and our reliance on technology is only set to increase.  

Employers with longstanding employees are likely to have changed record/filing systems over the employee’s length of service. Outside of the tribunal context, the increasing use of data subject access requests is leading to unwanted exposure of employers’ record keeping habits.  

Employers are increasingly reliant on technology to assist with all kinds of functions – from strengthening security to streamlining recruitment processes. But there are other legal risks that may be relevant but less obvious.

Subject Access Requests (SARs) are on the rise as more and more data is collected for social, personal and work purposes. In particular, we have noticed a significant increase within the context of employment and/or workplace disputes.

Many organisations have been struggling with a GDPR grey area since the Schrems II litigation.