Sexual Harassment Investigations and Subject Access Requests: A UK Employer’s Guide

A sexual harassment investigation ends. One party is unhappy with the outcome. A few days later, a subject access request (SAR) lands in HR’s inbox asking for “everything you hold about me”: witness statements, emails, notes, the lot.

This is one of the most common and most difficult crossovers between employment law and data protection. Get it wrong one way and you expose a complainant or witness. Get it wrong the other way and you breach UK GDPR.

Key terms

• Subject access request (SAR): an individual’s right under UK GDPR to obtain a copy of their personal data. It can be made verbally or in writing, and doesn’t need to be called a “SAR”.
• Special category data: information needing extra protection, such as health, sex life or sexual orientation.
• Third-party data: personal information about someone other than the person making the request.

Why the stakes are higher in 2026

Employers have had a duty under the Equality Act 2010 to take reasonable steps to prevent sexual harassment since October 2024. The Employment Rights Act 2025 strengthens this to all reasonable steps from 30 October 2026, and adds liability for harassment by third parties such as customers. Tribunal time limits for most claims have also been extended from three to six months.

In practice, that means more complaints being formally investigated, more records being kept, and more scrutiny of how those records are handled.

Can you refuse a subject access request because of the dispute?

No. An employee doesn’t need to give a reason for a SAR, and the ICO has confirmed that intending to use the information in litigation is not, on its own, grounds to refuse. You can only refuse requests that are manifestly unfounded or excessive, and that threshold is high.

The deadlines

• Respond without undue delay and within one month.
• Extend by up to two further months if the request is complex, as long as you tell the requester within the first month.
• Carry out a reasonable and proportionate search (confirmed by the Data (Use and Access) Act 2025).
• Pause the clock if you genuinely need clarification to locate the information.

An ongoing investigation does not pause the right of access.

Do you have to hand over witness statements?

Not automatically. The Data Protection Act 2018 lets you withhold information that would identify another person, unless they consent or it is reasonable to disclose without consent. To decide, weigh up:

• how sensitive the information is
• whether the witness was told their account would be confidential
• whether the requester already knows who they are
• the likely consequences for the witness if their identity is revealed.

The ICO gives the example of a bullying investigation where the employer lawfully withheld witness statements because redaction would still have allowed the employee to identify the witnesses.

Why removing names isn’t always enough

If only three people attended the event in question, removing one witness’s name may not anonymise them. The same goes for details of medical treatment or personal circumstances. Assess the risk of identification in context, based on what the requester already knows.

Fairness and data protection are separate tests

An accused employee is entitled to a fair disciplinary process. That usually means understanding the allegations and having a real chance to respond, which may require sharing evidence or a summary of witness accounts.

That is a different question from what UK GDPR requires in response to a SAR. You may need to share information for fairness that you wouldn’t have to provide in full under a SAR, and you can’t use GDPR as a reason to hide allegations. In finely balanced cases, take legal advice.

Five areas to get right

1. Record allegations as allegations

Keep findings clearly separate from what was alleged. An unproven allegation should never read as established misconduct. An employee disagreeing with a finding doesn’t make the record inaccurate.

2. Collect only what you need

Harassment cases often involve special category data. Identify a lawful basis and an additional condition, limit who can see the file and keep unnecessary personal detail out of reports and emails.

3. Be proportionate with message searches

Teams, email and work WhatsApp messages are often key evidence. Monitoring must be necessary, proportionate and transparent, and the ICO expects a data protection impact assessment for email or message monitoring. Covert monitoring should be exceptional. Remember that anything you collect may fall within a later SAR.

4. Set a documented retention period

There is no single statutory retention period for investigation files. Set one that balances your need to defend claims and evidence your preventative steps against the duty not to keep data longer than necessary. Preserve evidence if litigation is underway or reasonably expected.

5. Don’t promise absolute confidentiality

Tell complainants and witnesses that information will only be shared where necessary and lawful, and explain the limits. Over-promising creates problems later.

Quick checklist: when a subject access request arrives mid-investigation

• Log the date received and calculate the one-month deadline
• Identify all systems holding relevant data (HR system, email, Teams, WhatsApp, notes)
• Separate the requester’s data from third-party data
• Apply the third-party test document by document and record your reasoning
• Check whether redaction genuinely anonymises
• Involve your data protection lead and, where needed, legal advisers

Frequently asked questions

Can an employee make a subject access request during a disciplinary?

Yes. The investigation or disciplinary doesn’t suspend their right of access.

Does legal privilege protect HR notes?

Only genuinely privileged legal advice. Copying a solicitor in or marking a document “confidential” does not make it privileged.

Is every harassment allegation special category data?

No. It depends on what the information actually reveals, for example health or sexual orientation.

How PeopleFirstHR can help

Preventing harassment and handling complaints well both start with training. PeopleFirstHR Limited supplies Astute eLearning by VinciWorks, including sexual harassment prevention and UK GDPR courses for staff, managers and HR teams, with completion tracking that helps evidence the “all reasonable steps” you’ve taken.

Book a 20-minute Astute demo to see the courses and reporting.