When the DSAR arrives before the conversation: what AI-generated requests tell us about workplace trust

Earlier this week I joined Paul Griffiths, DPO at The DPO Centre, and Tom Beattie, employment law solicitor at Ashtons Legal, on the panel at The DPO Centre's breakfast event, Managing disruptive DSARs in the age of AI, at Ravenwood Hall near Bury St Edmunds.

Paul and Tom shared their expertise on the data protection and legal side: what employers are obliged to do, where the limits lie and when a request can be challenged. It was heartening to hear from Paul about his focus on developing the confidence of businesses when a DSAR is submitted – that while they are important to manage properly, a request is not carte blanche access to anything and everything.

Tom highlighted how much more frequently DSARs are being submitted alongside a grievance. The 30-day response window for a DSAR being used a way of forcing action from a company.  

My job was to ask a different question. Not "how do we handle these requests?" but "why are we getting them in the first place?"

The DSAR has changed

A subject access request used to be a short email or letter. Now anyone can ask a generative AI tool to write one, and in seconds they'll have a long, detailed document full of legal terminology, asking for everything the organisation holds about them. Generative AI has lowered the barrier to drafting complex, far-reaching requests – changing not just how many DSARs organisations receive but what they look like.

For HR teams, that means more data to find, review and redact, often with a one-month deadline and a team that's already stretched. In the Eastern counties of the UK – the area we particularly focus on, plenty of HR functions are one or two people.

It's not just DSARs

What struck me in preparing for the panel is that DSARs are one part of a wider pattern. Employees and candidates are using AI across every formal process where they feel the other side holds the power.

Grievances: A survey by The HR Dept found that 95% of HR directors had come across employees using AI to raise a grievance or navigate a dispute, and that 78% of AI-generated grievances relied on inaccurate information. This was mirrored by the event audience with over 75% saying they’d received a suspected AI-gen submission.

CVs: CV-Library found that 75% of candidates think AI is used to screen CVs, but only 21% of recruiters say they use it at that stage. People respond to what they believe the other side is doing. If employees think the organisation is using technology against them, they'll reach for it too.

Why employees feel they need to

It's tempting to see an AI-generated DSAR as a tactic, and sometimes it is. But in my experience, a DSAR in an employment setting rarely comes out of nowhere. It usually follows something: a concern that wasn't resolved, a disciplinary, a redundancy, a relationship with a manager that's broken down.

So the more useful question is why that person didn't feel able to sort it out earlier, face to face.

The research on speaking up is fairly consistent. People stay quiet for two main reasons: they're worried about what will happen to them, and they don't believe anything will change. An international survey by the Institute of Business Ethics found 43% of employees aware of misconduct worried that speaking up would put their job at risk, and 35% doubted anything would be done.

The second of those is the one I think HR underestimates. Someone who believes nothing will happen isn't necessarily afraid. They've just decided the informal route doesn't work. A DSAR, written with a tool that makes it sound authoritative, is a way of making the organisation respond.

The CIPD's Good Work Index 2025 points to where this breaks down. Only 37% of employees say their manager lets them influence final decisions, and only 60% of managers say they have the training to manage people well.

Put simply, when people don't feel safe raising things informally, they go formal. AI has just made going formal much easier.

AI isn't only a weapon

I think it's important to emphasise that for some employees, AI is what makes it possible to raise a concern at all. Someone who isn't confident writing, who's working in their second language, who's neurodivergent, or who finds confronting a senior colleague frightening, may only feel able to put their case with that help.

If our response is to treat every AI-written document as suspect, we risk shutting out exactly the people who already find it hardest to be heard.

What HR teams can do

None of this means accepting unlimited, unfocused requests. Paul and Tom were clear that there are legitimate ways to manage scope, and the Data (Use and Access) Act 2025 now puts a "reasonable and proportionate" search standard into law.

But alongside the process, there's a culture piece, and that's where HR can make a real difference.

• Talk to the person, not the document. A 40-page request often comes down to one or two real concerns. Asking "what are you hoping will happen?" can change the whole conversation.

• Invest in line managers. Most concerns are first raised with a manager. If they know how to listen, respond and follow up with confidence, fewer issues reach the formal stage. This could be coaching, it could be as simple as a template that helps managers keep a conversation on track

• Close the loop. If people raise things and hear nothing back, they learn that only formal routes get a response.

• Be open about your own use of AI. In recruitment especially, transparency about where AI is and isn't used reduces the sense of an arms race.

• Check your policy response. Word limits and accountability statements can be reasonable. But if they're the only thing you change, the message employees hear is "we're protecting ourselves", which is the very perception that sent them to AI in the first place. Plus of course, as Paul pointed out, if you set a word limit then a person will simply include the word limit request in their AI prompt.

Treat the DSAR as information

An AI-generated DSAR is a workload problem, and it's right that organisations learn how to handle them properly. But it's also information – telling you that somewhere, someone didn't feel able to have a conversation.

The organisations that will cope best are the ones who have the safety net of the Data Protection and Employment Law experts in their corner, AND who invest in the culture of their team enough to prevent a significant proportion of issues escalating at all.

If you'd like to talk about building psychological safety in your team, developing your line managers, or independent support with investigations and mediation, get in touch with us at Waddington Brown.

Thank you to the team at The DPO Centre for hosting such a timely event – you can find out much more about their expert support here