# A former employee's subject access request, run with Claira

_2026-10-06_

Szenario: An employer answering a former manager's subject access request, England and Wales: UK GDPR, with the Information Commissioner's Office as regulator and a likely employment tribunal claim

> Ein erfundenes Szenario nach einem typischen Sachverhalt. Die Parteien sind frei erfunden, und nichts hiervon ist Rechtsberatung.

## A request that arrives before the claim

Corvane Logistics, an invented haulage company in England, receives a letter from solicitors acting for a depot manager who resigned after a grievance about a shift supervisor was rejected. The letter is a subject access request under Article 15 of the UK GDPR, and it reads like a request for early disclosure. A claim in the employment tribunal is likely to follow, and anything sent now will be read by the other side's lawyers.

We act for Corvane, and the deadline is the first fact on the file. The ICO's guidance gives an employer one month from receipt to respond, extendable by up to two months where a request is complex, and it says a grievance or tribunal process is no reason to refuse. Since the Data (Use and Access) Act 2025, Article 15 states that the requester is entitled to what the controller can provide on a reasonable and proportionate search, a rule treated as in force from January 1, 2024. The search itself may later need defending, so the team should be able to show how it was run.

## Measuring what has to be searched

Corvane's IT team collects the mailboxes of the requester, the supervisor and the managers who handled the grievance, along with the HR file, Teams chats, a WhatsApp export from a depot phone, scanned handwritten notes of the grievance meeting and an audio recording of the appeal hearing. The ICO's guidance for employers says that business use of WhatsApp or Teams brings those messages within the employer's control, so leaving the phone out would be hard to defend.

Once the collection is loaded into Nuix Discover, Claira's [early case assessment](https://support.claira.to/docs/en/ai-review/early-case-assessment) reads the metadata of every document and reports the custodians, file types, languages, senders and recipients, with a monthly timeline that shows spikes and gaps. It runs from the Claira menu under More, with **Run assessment**, and writes nothing to Discover. The team would download the PDF and keep it with the file, since it records what was collected and the period it covers before anyone narrows the set.

## A brief for the review, and the search terms that follow from it

The request is about one person, so the [Case Context](https://support.claira.to/docs/en/case-context/setting-up) has to know every way that person appears in the documents. The team would open Case Context, choose the Employment template, select the request letter, the grievance, the outcome letter and the resignation in Discover, and click **Generate from selection**, which reads up to five documents. Claira fills the sections and lists up to five questions under Missing information, which the team can answer with the Agent. The answers worth adding are the requester's nicknames, initials and employee number, and the solicitors Corvane has used, because those names decide the privilege calls later.

Once a partner approves it, **Generate search terms** produces an Excel file of search terms for Nuix. The searches themselves run in Nuix Discover, outside Claira, and the team should record the terms and their hits there, because that record is what shows the search was reasonable and proportionate.

## One pass that answers several questions

With the search hits selected in Discover, the team would build a Multi-Code scan, which runs one shared instruction into up to ten fields in a single pass. For a subject access request the fields follow the decisions the response needs: whether the document contains the requester's personal data, the passages that do, the other people it identifies, whether it may be privileged, and whether it may fall under the exemptions for negotiations with the requester or confidential references. The prompt should tell Claira to answer from the document alone and to leave a field empty when the document is silent.

Before the [bulk scan](https://support.claira.to/docs/en/ai-review/bulk-scan), the prompt is tried on ten to twenty-five documents in Single Review. The handwritten notes and the hearing recording need their own runs, with Scan as set to image or audio, because text mode reads extracted text only. Results land in the team's Discover fields while the scan runs, so review can begin before it finishes.

## Checking the privilege calls and the third parties

Two kinds of call need a lawyer's eye, and privilege comes first. Claira's [privilege prompt](https://support.claira.to/docs/en/workflows/privilege-review) is written for Canadian law and is meant to be adapted, so for an English matter the prompt should name legal advice privilege and litigation privilege, and the Case Context should list Corvane's solicitors and the date a claim became likely. The team would read every document flagged as possibly privileged and a sample of those that were not.

Third-party data comes second. The [PII Identification](https://support.claira.to/docs/en/workflows/pii-identification) workflow can list each name, email address and phone number as written, in a comma-separated form built for Nuix Discover's search term families, which gives the team a redaction list to work from. It reads extracted text and may miss handwriting or poor OCR, so the scanned notes get a manual check. Where Claira and a reviewer disagree, the prompt is revised, and each bulk task records which prompt version it ran.

## The decisions that stay with the lawyers

Much of a subject access response is balancing that Claira can inform and cannot make. An email about the requester written by a colleague contains both people's data, and the ICO's guidance lets the employer withhold the colleague's details unless the colleague consents or it is reasonable to disclose them without consent. Whether a manager's note records Corvane's intentions in settlement talks, or whether a reference was given in confidence, are judgements about context and purpose.

The redactions themselves are applied in Nuix Discover, using the lists and fields Claira has filled. The team also decides where the search stops. The amended Article 15 supports a proportionate search, and the ICO says a request is not excessive merely because it involves a lot of information, so the file note should explain why each source was searched or left out.

## A chronology for the claim that follows

The same coded set serves the tribunal claim the letter anticipates. A second bulk scan with Claira's [chronology prompt](https://support.claira.to/docs/en/workflows/chronologies) writes a one-sentence dated summary of each document, and an Insight built from that bulk task with the Chronology template turns them into a table of events. In the Timeline format, a table with a date column is shown by month and can be filtered by participant, so the grievance, the investigation meeting, the outcome and the resignation can be read in order.

For the defence, the chronology shows early where Corvane's own record is thin, such as a meeting the emails refer to that has no notes of its own. An Insight can cite the documents behind each entry. Its automatic citation check confirms that a cited document exists without verifying the fact, so an associate should check each row against its source.

## What goes out, and what stays on file

The review ends in two packages. The requester's solicitors receive copies of the personal data with the redactions applied in Discover, together with the information Article 15 requires about purposes, recipients, retention and sources, which the lawyers write. Internally, an [Insight](https://support.claira.to/docs/en/ai-review/insights) from the Privilege Logs template can list what was withheld and the ground for each item. Insight tables hold up to six columns, so the team should choose them with care, and the Excel and Word exports stay editable.

The second package is the record of the search. The early case assessment PDF, the approved Case Context PDF and the bulk task history report, which carries the prompt text, the model and the comments the team left on each task, together show how the review was run. If the requester complains to the ICO, or the tribunal later asks about the response, the firm can produce the scope of the search and the method behind each decision.

## Quellen

- [Data (Use and Access) Act 2025, section 78 (searches in response to data subjects' requests), legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2025/18/section/78)
- [UK GDPR, Article 15 (right of access by the data subject), legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/15)
- [ICO, Subject access request Q and As for employers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/subject-access-request-q-and-as-for-employers/)
- [ICO, What exemptions are relevant for SARs?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/exemptions-when-can-we-refuse-a-sar/)
- [ICO, The Data Use and Access Act 2025: what does it mean for organisations?](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/)