GDPR - subject access request

[MrsSchadenfreude]

I have good reason to believe that someone in my organisation has been emailing HR maliciously, trying to get me into trouble. If I put in a subject access request, are they obliged to show me the emailing, and if they are, will the name of who has sent the malicious emails, be redacted?

They are only obliged to show you the emails if they exist, have been kept in your records and they can do so without revealing the identity of the sender. Telling you who sent the emails or giving you enough information to work it out for yourself would definitely be a breach of GDPR.

Thank you. It was an anonymous letter, so I guess they can show me.