Help with SAR and GDPR

[Peaky47]

Have name changed.

Background: Work colleague raised a grievance against our mutual manager. It’s been ongoing for a number of months and during this time the work colleague has been signed off on sick leave. I am friends with said colleague and have sporadically kept in touch via text message outside of work - mainly talk about kids / family etc but nothing work-related.

I was called as a witness to a meeting with HR some weeks back regarding the grievance which I found most uncomfortable and also had to provide a statement. Have now received an email from employer advising that work colleague has submitted SAR. Employer has asked me to send them copies of all email correspondence mentioning their name, from myself.

This is all a bit new to me so my question is do I have to comply? In addition, I have copies of conversations between myself and colleague but on Skype, and these conversations have been ‘saved’ in Outlook. Do I need to send these as well? (Some of these conversations contain personal views, not sensitive in that respect, but my own views on things)

I have searched for other emails but if there were any I appear to have deleted them - I do often have a purge of my inbox from time to time!

Yes you have to reply. It's the law.

Yes you do, but the request should be coming via and be dealt with by your company's Data Protection Officer, not HR (unless the DPO happens to be one of the HR team).

It is then up to the DPO to decide whether the emails should be shared with the person making the SAR or whether they fall under the exemptions.

If they're all only work related emails though, not sure why you WOULDN'T want to send them..... ?

Yes you do. They may be able to redact your identity.

Thanks for your replies. I’ll get straight on it and send what I’ve got.