This guide is maintained as a current resource for September 2026 and covers only the laws of England and Wales. Information is for general guidance, not legal advice. Consult a qualified solicitor for advice specific to your situation.
Comprehensive guide to data protection issues in workplace discrimination claims in England and Wales, explaining UK GDPR obligations, handling of personal and special category data, tribunal disclosure, subject access requests, and practical steps for claimants and employers.
Discrimination claims in the workplace often involve handling substantial amounts of personal information. In England and Wales, data protection law - principally the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 - governs how employers, employees and tribunals must process personal and sensitive data. Discrimination claims under the Equality Act 2010 frequently hinge on evidence that includes personal details, yet that evidence must be managed in a way that protects privacy and complies with data protection obligations. Missteps in handling data can compromise privacy rights, lead to regulatory enforcement by the Information Commissioner's Office (ICO), and affect the strength of discrimination cases in employment tribunals or courts. This guide explains key data protection concepts, how they interact with discrimination claims, what practical steps parties should consider, and common questions about personal data in this context.
What Personal Data Is and Why It Matters in Discrimination Claims
Under UK GDPR, personal data is any information that identifies or could identify a living individual. Examples include names, contact details, job roles, performance appraisals, workplace emails and meeting records. Many claims also involve special category data, which are types of personal data requiring extra protection because they reveal sensitive aspects of a person's life such as:
- Racial or ethnic origin
- Religious or philosophical beliefs
- Trade union membership
- Health information, including mental or physical conditions
- Gender reassignment
- Sexual orientation
These categories are often relevant to discrimination claims because they directly correspond to protected characteristics under the Equality Act 2010. Processing special category data without a lawful basis and appropriate safeguards increases legal risk.
Data protection obligations apply to all data a controller holds, whether on paper or in electronic form. Employers routinely process employee data for HR functions, grievance investigations and tribunal preparation, so understanding how to manage it lawfully is essential.
Legal Framework: UK GDPR and the Data Protection Act 2018
Lawful Basis and Special Conditions
Under the UK GDPR, every processing activity requires a lawful basis (such as legitimate interests or legal obligation) and, where the data is special category, an additional condition (such as necessary for employment law claims or health and safety). Employers must be transparent about why they process personal data and should document their lawful basis. Employers and individuals involved in discrimination cases should be especially aware that health and other sensitive data relating to the claim must be handled with heightened care.
Data Minimisation and Security
The UK GDPR principles include collecting only the minimum personal data necessary for the purpose and storing it securely. Employers must protect data from unauthorised access, accidental loss or disclosure. If organisations fail to implement appropriate technical and organisational measures (for example, secure HR systems), this can lead to ICO action, including fines or reprimands.
Data Protection in the Context of Discrimination Claims
Evidence Disclosure and Personal Data
Discrimination claims to an employment tribunal often require disclosure of documents that may contain sensitive personal information about the claimant, co‑workers or managers. These documents might include emails, witness statements, meeting notes and HR files. Both claimants and respondents must disclose relevant evidence, and while privacy rights remain, parties cannot simply redact or withhold personal data unilaterally if it is relevant to an issue in dispute. In tribunal proceedings, the proper way to address privacy concerns is to seek tribunal orders under the Employment Tribunal Rules or Civil Procedure Rules to limit disclosure only where justified, rather than independently redacting evidence.
Subject Access Requests and Tribunal Evidence
Employees and former employees can make a Subject Access Request (SAR) to obtain copies of personal data held about them. SARs can be useful in preparing discrimination claims because they can reveal records the employer holds, but SAR responses may be partial or heavily redacted where third‑party privacy is at stake. Some claimants face difficulties when data is over‑redacted, making it hard to understand context or link documents to events. In practice, tribunal disclosure obligations may provide more complete evidence than SARs alone.
Retention and Over‑Retention of Data
Employers must not retain personal data longer than necessary for the purposes for which it was collected. However, there is no strict rule preventing data from being used as evidence in a tribunal simply because it has been retained beyond retention periods. In some cases, tribunals have admitted documents retained in breach of data protection rules if they are relevant to the discrimination claim, though such retention may expose the employer to separate data protection complaints.
Automated Processing and Fairness
When organisations use automated systems - for example, performance scoring tools or AI - to process employee data, UK GDPR requires that such processing is fair, transparent and does not have unjust discriminatory effects. This intersects with discrimination law because inappropriate algorithmic decision‑making can amplify bias and create separate data protection obligations to conduct impact assessments that consider both privacy and fairness.
Practical Steps for Employers
- Document lawful basis and special category conditions: Clearly identify why each category of data is processed in relation to discrimination claims and how it is protected.
- Implement security measures: Ensure encrypted storage, restricted access and safeguards against loss or unauthorised access.
- Provide clear privacy notices: Inform employees when data is collected and how it will be used, including in investigations or legal proceedings.
- Train HR and managers: Regular training helps staff understand data protection when handling sensitive information.
- Seek tribunal privacy orders where necessary: Instead of unilateral redaction, apply for orders that limit disclosure to relevant parties or under protective terms.
Practical Steps for Claimants
- Submit a Subject Access Request: Use SARs to gather evidence about what personal data your employer holds.
- Review privacy notices: Understand how your employer said your data would be used.
- Secure evidence lawfully: Avoid public sharing of personal data; seek legal advice if uncertain.
- Consider ICO complaints if breaches occur: Complaints to the ICO can support your position if data was mishandled, though the ICO does not award compensation directly.
Risks and Potential Liabilities
Employers risk regulatory action and reputational harm if they fail to comply with data protection obligations. Breaches that expose sensitive personal data without legal basis or proper security can lead to ICO enforcement including fines and reprimands. Mishandling data can also undermine internal investigations and damage an employer's credibility in a discrimination claim.
Claimants also face challenges if they mishandle personal data when preparing a claim or sharing evidence publicly, as data protection law continues to apply even outside employment contexts.
Common Questions
Can an employer refuse to disclose personal data in a tribunal?
In discrimination cases, parties must disclose relevant evidence. Blanket refusal based on privacy is not usually acceptable; instead, privacy concerns are addressed through tribunal orders.
Is special category data treated differently?
Yes. Special category data - including health, race or sexual orientation - requires an additional lawful condition under UK GDPR. Claims involving sensitive information require strong justification and careful handling.
Can I sue my employer for mishandling my data?
If your employer breaches data protection law and this harms you, you may have a civil claim, but discrimination claims and data breach claims are separate legal avenues. The ICO can investigate breaches but does not award compensation.
Final Thoughts
Data protection issues are a critical dimension of workplace discrimination claims in England and Wales. Understanding how personal and special category data must be handled under UK GDPR and the Data Protection Act 2018 helps both employers and claimants navigate evidence gathering, tribunal procedures and legal rights. Clear lawful bases, secure processing, transparent privacy notices, and appropriate tribunal privacy protections can reduce risk and support fair, effective resolution of discrimination claims.
