The 41,000-email request and the promise of confidentiality
On Monday 3 March a UK retailer receives an email from a former sales manager who resigned in January: 'Under GDPR I want a copy of all my personal data, including every email I sent or received on the company account, my manager's handwritten notes, and the audio of my two performance meetings.' The company has 260 staff, one HR system, Microsoft 365 mailboxes and a three-year email retention rule. The former manager's mailbox held about 41,000 messages. HR holds 180 pages, including notes of two grievance interviews with colleagues who were told their statements would stay confidential, and a reference draft that was never sent. On 28 March the DPO is on leave; nobody has responded. The requester has also asked for 'everything you got from my old manager about me' - the manager left the company in February.
1. What is the deadline, can it be extended, and is this request 'manifestly unfounded or excessive'?
Read the worked answer
Deadline. Article 12(3): one month from receipt, so 3 April. The clock runs from receipt by any part of the organisation, not from when the DPO returns.
Extension. Article 12(3) allows a further two months where the request is complex or numerous, but only if the controller informs the requester within the first month and explains the reason. Waiting until 28 March to notice the file is poor practice but does not remove the right to extend - the notification must still go out before 3 April.
Manifestly unfounded or excessive. Broad scope alone is not enough; the burden of proof sits with the controller. Factors that count: purely vexatious intent, repeated requests, or a request that is clearly disproportionate in effort. Forty-one thousand emails is large but mechanically searchable, so compare the actual effort against the value - this is a single, first-time request from an individual with an employment dispute. It is more likely excessive in scope than manifestly unfounded, which argues for asking the requester to narrow by date range, senders or search terms rather than refusing.
A fee is only available in the narrow Article 12(5) case and must be justified with evidence of administrative burden. Refusing without that evidence converts a defensible position into an infringement.
2. How should the company handle the 41,000 emails and the confidential grievance notes?
Read the worked answer
Emails. They are personal data where they relate to the requester and are held in a structured system. The controller must search proportionately - date range, mailbox, sender/recipient terms, keywords - and document the search strategy, because the strategy is the defence. Each retrieved message must then be reviewed: the requester's own data is disclosable; third-party data is not, unless the third party consents or disclosure is reasonable. Redact names, contact details, opinions about others and anything that would identify a complainant, and log the redactions.
Grievance notes. A promise of confidentiality is not a trump card, but it is a legitimate factor. Article 15(4) protects the rights and freedoms of others, and Recital 63 recognises that the right of access should not adversely affect others. The usual answer is to disclose the substance of what concerns the requester while withholding the identity of complainants and any collateral personal data. That gives access without destroying the grievance process.
Handwritten notes and the unsent draft. Handwritten notes in an HR file are in a relevant filing system and are in scope. An unsent reference draft relates to the individual and is personal data; draft status does not remove it.
The departed manager. No personal data is exempt because the author has left. If necessary, contact the manager, but disclosure cannot be blocked indefinitely.
Document every decision: what was searched, what was withheld, and on which exemption.
3. What must the response contain, and what are the consequences of the delay so far?
Read the worked answer
Content of the response (Articles 15(1)–(2)). Purposes of processing; categories of data; recipients or categories of recipient, including processors such as the payroll and email providers; retention periods or the criteria used, referencing the three-year rule; the existence of rights to rectification, erasure, restriction, objection and complaint to the ICO; the source of data not collected from the requester; any international transfer and its safeguard; and a copy of the personal data undergoing processing, with redactions explained.
Format. A secure, commonly used electronic format where the request was made electronically - not a link to a mailbox export containing third-party data.
Delay. Silence past 3 April is an Article 12 infringement. Consequences: a complaint to the ICO and possible enforcement, including an information and assessment notice and, ultimately, a fine under Article 83(5); a claim under Article 82 for distress, which UK courts have accepted for access failures; and evidential damage in the employment tribunal, where an incomplete disclosure is often more damaging than the contents.
Immediate action. Confirm receipt, explain the extension with reasons, propose search parameters, assign a named handler and brief the DPO. Freezing deletion under the three-year rule for this mailbox avoids a spoliation argument.