employee-dsar-response

name	employee-dsar-response
title	Employee DSAR Response
description	Manages Data Subject Access Request procedures for employee requests under Art. 15 GDPR. Covers scope of disclosable HR records, emails, CCTV footage, performance reviews, monitoring data, and training records. Implements third-party data redaction, legal professional privilege, exemptions for ongoing proceedings, and the one-month response timeline. Keywords: DSAR, subject access request, Art. 15, employee records, redaction, privilege, HR data, SAR.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/employee-dsar-response
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	general
practice	data-protection
language	en

Employee DSAR Response

Overview

Employee Data Subject Access Requests (DSARs) are among the most complex and resource-intensive DSARs that organisations receive. Unlike customer DSARs, which typically involve a defined set of transactional data, employee DSARs can span the entire employment lifecycle and encompass data held across dozens of systems: HR records, emails (sent, received, and about the employee), CCTV footage, access control logs, telephone recordings, performance reviews, investigation files, grievance records, occupational health reports, training records, payroll data, expense claims, monitoring data, and informal notes and communications between managers. The scope, combined with the need to redact third-party personal data and assess legal privilege, makes employee DSARs a distinct operational and legal challenge.

This skill provides a structured response process, a comprehensive data source inventory, and decision frameworks for the exemptions and redactions most commonly encountered in employee DSARs.

Art. 15 — Right of Access

What the Employee Is Entitled To

Under Art. 15(1), the employee has the right to obtain from the controller:

Information	Detail
Confirmation of processing	Whether personal data concerning the employee is being processed
Access to the data	A copy of the personal data undergoing processing
Purposes	The purposes of the processing
Categories	The categories of personal data concerned
Recipients	Recipients or categories of recipients to whom data has been or will be disclosed
Retention	The envisaged period of storage, or criteria used to determine the period
Rights	The right to rectification, erasure, restriction, and objection
Source	Where data was not collected from the employee, information about the source
Automated decisions	The existence of automated decision-making including profiling under Art. 22, with meaningful information about the logic, significance, and envisaged consequences
Transfer safeguards	Where data is transferred to a third country, the appropriate safeguards under Art. 46

Art. 15(3) — Format

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested, the controller may charge a reasonable fee based on administrative costs. Where the request is made by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested.