Sexual harassment investigations are among the most sensitive matters an employer can handle. They involve competing accounts, potentially serious allegations and deeply personal information. An investigation may result in disciplinary action, dismissal or an employment tribunal claim. Even where a complaint is not upheld, the consequences for those involved can be significant.
The Employment Rights Act 2025 is placing greater obligations on employers to prevent sexual harassment. At the same time, UK data protection rules in GDPR and the Data Protection Act 2018 gives employees the right to access personal information held about them, including information collected during workplace investigations.
These obligations can create serious difficulties for HR teams. An employee who has been accused of sexual harassment may make a subject access request (SAR), seeking copies of allegations, witness statements, internal correspondence and investigation findings. Equally, an employee whose complaint has been dismissed may request information to understand how the employer reached its decision.
Subject access requests are particularly common in employment disputes. In a sexual harassment investigation, either party may feel dissatisfied with the outcome. The employee who considers themselves the ‘losing’ party may use a SAR to challenge the investigation or gather information for possible legal proceedings.
The difficulty for employers is that disclosing one employee’s personal information may expose another employee’s private and potentially highly sensitive information. Employers must comply with data protection law without compromising confidentiality, exposing witnesses to unnecessary risks or undermining the fairness of the investigation.
How the Employment Rights Act changes the picture
Since October 2024, employers have been subject to a proactive duty under the Equality Act 2010 to take reasonable steps to prevent sexual harassment of their employees. The Employment Rights Act 2025 strengthens this framework. From 30 October 2026, under the government’s published implementation timetable, employers will be required to take all reasonable steps to prevent sexual harassment. The Act also introduces liability relating to harassment by third parties, including customers and clients, where employers fail to take all reasonable steps to prevent it.
The implications extend beyond preventing harassment in the first place. Employers need effective reporting procedures, appropriate investigations and reliable records demonstrating how complaints have been addressed. Investigations should establish the facts impartially, provide the accused employee with a fair opportunity to respond and protect complainants and witnesses against inappropriate disclosure or retaliation.
The ERA has also strengthened protections for workers making qualifying whistleblowing disclosures about sexual harassment, with those changes taking effect on 6 April 2026. Employment tribunal time limits were generally extended from three to six months from 1 October 2026, increasing the importance of considering potential claims when managing investigation records. These changes make the relationship between employment law and data protection particularly significant.
Why a subject access request can complicate an investigation
Under UK GDPR, an individual has a right to access their personal data held by an organisation, subject to applicable restrictions and exemptions. In a workplace investigation, personal data may include allegations made about an employee, records of interviews, emails discussing their behaviour, messages collected as evidence and conclusions recorded in an investigation report.
An employee does not need to explain why they are making a SAR. They can make the request verbally or in writing, and they do not need to describe it formally as a subject access request. Crucially, an employer cannot reject a valid SAR simply because the employee is involved in a grievance, disciplinary procedure or employment tribunal claim. The ICO has confirmed that an intention to use information in litigation does not, by itself, justify refusal.
Consider a sexual harassment investigation in which a manager is accused of sending inappropriate messages to a junior colleague. The employer interviews several witnesses, reviews workplace communications and ultimately dismisses the manager.
The manager then submits a SAR requesting all personal information relating to the allegations and investigation, including witness statements and internal HR discussions. Some of that material will contain the manager’s personal data. However, it may also reveal the complainant’s experiences, information about their private life, confidential statements from witnesses or concerns raised by other employees.
The employer must examine what information the manager is entitled to receive and what information can lawfully be withheld. The same problem can arise in reverse. If a complaint is not upheld, the complainant might submit a SAR seeking records of the investigation, including information about the accused employee’s disciplinary history or confidential comments made by colleagues. Both employees have data protection rights. Neither automatically has a right to access the entire investigation file.
Can employers withhold witness statements and other sensitive information?
One of the most difficult questions concerns witness statements. The Data Protection Act 2018 provides an exemption where responding to a SAR would disclose information identifying another individual, unless that individual has consented or it is reasonable to disclose the information without their consent.
This is particularly relevant to sexual harassment investigations, where a single statement may contain personal information about the complainant, accused employee and several witnesses. Employers must consider the circumstances of each disclosure, including the sensitivity of the information, expectations of confidentiality and the possible consequences for the individuals involved.
The ICO provides a directly relevant example involving an employee accused of bullying. In that case, the employer withheld confidential witness statements because redacting them would still have allowed the employee to identify the witnesses. The ICO confirms that such an approach may be justified.
However, employers cannot automatically withhold every witness statement simply because it is confidential. They must consider whether it is possible to provide the requester’s personal information without revealing protected information about others.
Why removing names might not be enough
Imagine a complaint alleging that a manager made sexually inappropriate comments during a business trip. Only three employees attended the trip, and one of them provided a witness statement. Removing the witness’s name is unlikely to provide meaningful anonymity. The manager may be able to identify the witness from the circumstances described, the wording of the statement or details of conversations.
Similarly, a witness statement might refer to a complainant’s medical treatment, previous experiences of harassment or private relationships. Even if the individual’s name is removed, those details might still reveal their identity or disclose sensitive information.
Employers must assess the risk of identification in context, taking account of what the requester already knows. If effective anonymisation is impossible, withholding the relevant information may be lawful after applying the statutory test.
What if the accused employee needs the information to defend themselves?
Here the employment law and data protection obligations become especially complicated. A fair disciplinary investigation generally requires that an accused employee understands the allegations and has a meaningful opportunity to respond. Depending on the circumstances, this may require disclosing relevant evidence or sufficient detail about witness accounts.
Yet the employee’s right to a fair disciplinary process is distinct from their right of access under UK GDPR. An employer may therefore need to disclose information during disciplinary proceedings to ensure fairness, even where it would not be required to provide the entire underlying document in response to a SAR.
Equally, an employer cannot rely on GDPR as a blanket justification for concealing allegations or evidence needed for a fair disciplinary process. HR teams must assess what fairness requires in the investigation separately from what data protection law requires in response to a SAR. In particularly sensitive cases, legal advice may be necessary to reconcile these obligations.
Sexual harassment allegations will likely involve special category data
Sexual harassment investigations frequently involve information that requires enhanced protection under UK GDPR. There are special protections for certain categories of personal data, including information concerning an individual’s health, sex life or sexual orientation, known as special category data.
For example, an investigation might include medical information about the impact of an alleged incident, details about someone’s sexual orientation or highly personal information concerning relationships.
Not every allegation of sexual harassment automatically constitutes special category data. The classification depends on what the information actually reveals or concerns. Where special category data is processed, employers must identify an appropriate lawful basis and an additional condition. Some conditions also require compliance with safeguards under the Data Protection Act 2018.
Where allegations involve conduct potentially amounting to a criminal offence, additional restrictions may apply under UK GDPR and the Data Protection Act 2018. These safeguards can apply to unproven allegations of criminal conduct, as well as convictions.
This reinforces the importance of collecting only relevant information, controlling access to investigation files and ensuring that sensitive information is not unnecessarily included in correspondence or reports.
Employers must also be careful about how they record allegations. An allegation that has not been established should be clearly recorded as an allegation, with the outcome of the investigation accurately documented. An employee’s disagreement with a finding does not automatically render the record inaccurate.
How long should employers keep sexual harassment investigation records?
Another difficulty arises from the need to retain evidence. Employers may need investigation records to demonstrate that they have taken appropriate steps to prevent and address sexual harassment, defend employment tribunal proceedings or respond to regulatory scrutiny.
The strengthened preventive duties under the ERA make this particularly relevant. However, UK GDPR requires personal data to be kept for no longer than necessary for the purposes for which it is processed.
There is no universal statutory GDPR retention period for sexual harassment investigation files. Employers must determine and justify appropriate periods based on the purposes of retention, relevant legal requirements and foreseeable litigation. The ICO specifically warns against applying one retention period to every type of employment information.
This creates a difficult balance. Deleting investigation records too quickly could leave an employer unable to defend its actions in a future tribunal claim. Retaining highly sensitive allegations indefinitely could breach data protection law and unnecessarily expose employees to future privacy risks.
Employers should establish documented retention schedules for investigation files, taking account of applicable limitation periods, ongoing proceedings and the potential need to demonstrate compliance with their preventive duties.
Where a complaint is not upheld, employers should consider carefully what information remains necessary and how the outcome is recorded. An unsubstantiated allegation should not be retained or presented as though misconduct has been established.
If litigation is underway or reasonably anticipated, relevant evidence may need to be preserved notwithstanding ordinary deletion schedules. Retention should then be reviewed when the justification for keeping the material changes.
Can employers monitor emails, Teams and WhatsApp messages during an investigation?
Workplace communications are increasingly important evidence in sexual harassment investigations. Allegations might concern inappropriate messages on Microsoft Teams, sexually explicit content shared through workplace chat groups or comments made on WhatsApp.
Employers may need to examine these communications to establish what happened. However, accessing or monitoring employee messages engages additional UK GDPR obligations.
The ICO requires monitoring to have a clear purpose and to be necessary and proportionate. Workers must be informed about the purpose of monitoring, and employers considering email and message monitoring must carry out a data protection impact assessment (DPIA).
An employer investigating an allegation may have good reason to examine relevant communications on its work systems. That does not provide unlimited authority to search employees’ private messages or monitor unrelated personal conversations.
Any investigation should consider whether the evidence can be obtained through a less intrusive method, such as requesting relevant screenshots or limiting searches to specified employees, channels and periods.
Covert monitoring requires particular caution. The ICO expects it to be exceptional, appropriately authorised and restricted to circumstances where informing the employee would prejudice the prevention or detection of suspected criminal activity or equivalent serious misconduct.
There is also a second data protection consequence to consider. Once an employer has obtained messages for an investigation, those messages may become relevant to a subsequent SAR. Business-related WhatsApp communications, Teams messages and information held on other relevant platforms may fall within the scope of a reasonable and proportionate search. Employers cannot assume that information is excluded merely because it is held outside the central HR system.
What happens when a SAR arrives during an ongoing investigation?
Employers may find themselves responding to a SAR while allegations are still being examined. An accused employee might request all information about a complaint before witnesses have been interviewed. A complainant may ask to see what managers are saying about the allegations while disciplinary proceedings are underway.
These requests can create risks of inappropriate disclosure, interference with evidence or pressure being placed on witnesses. However, the fact that an investigation is ongoing does not automatically suspend the employee’s right of access.
Employers must identify what personal data is held, consider relevant exemptions and respond within the statutory deadline. Under the current UK GDPR framework, which has been amended by the Data (Use and Access) Act 2025:
- Employers must generally respond without undue delay and within one month.
- The deadline can be extended by up to two additional months where necessary because of the complexity or number of requests, provided the requester is notified within the initial period.
- Employers must undertake a reasonable and proportionate search.
- Where further clarification is reasonably required to identify the requested information or processing activities, the response clock can be paused while clarification is awaited.
These are statutory rights and limits, rather than discretionary HR procedures.
A request cannot simply be refused because an employee is angry about the outcome, intends to pursue litigation or is considered difficult by management. Although employers may refuse requests that are manifestly unfounded or excessive, the threshold is high and the decision must be supported by evidence.
Employers should also remember that genuinely privileged legal advice may be exempt from disclosure. Merely copying a lawyer into correspondence or marking material confidential does not automatically establish legal professional privilege.
Managing the competing rights of the complainant and accused employee
Sexual harassment investigations require employers to protect individuals who report misconduct while ensuring that the accused receives fair treatment. Data protection obligations apply to both parties. The complainant has legitimate expectations regarding the confidentiality of personal information shared during an investigation. This may be particularly important where disclosure could expose them to intimidation or retaliation.
The accused employee also has legitimate rights. Allegations can have severe professional consequences, and an employee may reasonably seek to understand what personal information an employer holds about them. These interests must be considered without prejudging the allegations or treating one individual’s privacy rights as automatically superior.
Where disclosure is contemplated, employers should consider the sensitivity of the information, whether the requester already knows the other person’s identity, any reasonable expectation of confidentiality and the impact disclosure could have on those involved.
Consent from the other party may sometimes permit disclosure. However, the ICO recognises that seeking consent can be inappropriate in an employment relationship because of the imbalance of power. Even where consent is refused, an employer must still assess whether disclosure without consent would be reasonable.
Employers should therefore avoid promising absolute confidentiality at the outset of investigations. A more appropriate approach is to explain that information will be shared only where necessary and lawful, recognising that some disclosure may be required for procedural fairness, statutory access rights or legal proceedings.
How employers can reduce the risks
The interaction between the ERA and UK GDPR means employers should review how they conduct, document and manage sexual harassment investigations. A compliant approach should start before a complaint is received.
Investigation procedures and data protection policies should work together. HR teams need to understand what information they can collect, how it should be stored, who can access it and what may be disclosed if either party submits a SAR.
Investigation records should distinguish allegations from findings, avoid unnecessary personal details and accurately record the reasoning behind decisions. Witnesses should receive clear explanations about confidentiality and its limits.
Access to sensitive case files should be restricted to those who need the information. Communications monitoring should be proportionate and supported by appropriate policies and assessments.
Employers should also establish a coordinated SAR process involving HR, data protection and legal specialists where necessary. Reviewing documents line by line, assessing whether individuals remain identifiable after redaction and recording the legal basis for withholding material can help avoid disclosure errors.
Finally, retention schedules should reflect both the employer’s need to preserve evidence and its obligation to delete personal information when it is no longer necessary. These arrangements should form part of broader sexual harassment prevention training, particularly for managers and HR professionals who may receive complaints or access investigation information.
