Settlement of data subject access requests through em-ployment settlements

The increasing number and complexity of access requests requests, particularly in employment relationships, present companies with growing practical challenges. This makes it all the more relevant for practice to determine the limits within which access rights under Article 15 GDPR can be excluded or settled, especially in employment settlement agreements. Current German case law permits such contractual arrangements within narrow boundaries. At the same time, the permissibility of such waivers is a data protection "minefield." After all, the right to data access is constitutionally guaranteed in Article 8(2) sentence 2 of the Charter of Fundamental Rights of the European Union (CFR), as the CJEU has repeatedly emphasized. In this article, we briefly summarize how companies can significantly reduce their "DSAR burden" through contractual arrangements.

1. Access requests as a major challenge for companies

Access requests under Article 15 GDPR from (former) employees cause considerable workload in companies and tie up valuable resources. Particularly in the frequent practical cases where (former) employees request information about "all my data," companies are forced to undertake extensive measures. Often, large email stocks or extensive datasets must be collected, filtered, searched, and possibly redacted in so-called collaboration tools. A contractual exclusion of such access rights therefore has high practical relevance. Nevertheless, it is still largely uncommon in practice to include data subject access requests in termination agreements or other settlement agreements. Although the legal discussion on the permissibility of a contractual waiver of access rights is still in its early stages, companies already have considerable room for maneuver in this regard.

The starting point of the legal discussion is Article 15 GDPR, Article 8 CFR (fundamental right to data protection), employment settlement law, and the EU law limits on the disposability of data subject rights. Added to this are the—rather restrictive—guidelines of the supervisory authorities, particularly the EDPB, which warns against undermining access rights through contractual clauses. Companies thus find themselves in a field of tension between procedural efficiency, protection of fundamental rights, and inconsistent case law.

2. Current state of dispute

In its judgment of May 13, 2025 (2 A 165/24), the Higher Administrative Court of Saarland (OVG Saarland) ruled that a comprehensive settlement clause in an employment court settlement can cover a claimed access right under Article 15 GDPR. The court qualifies the access right as fundamentally disposable and holds that an effective waiver is possible at least when the employment relationship has been terminated and the waiver is limited to past processing operations.

The clause used ("all claims arising from the employment relationship and its termination, whether known or unknown, regardless of their legal basis") was interpreted by the OVG Saarland to also cover data subject access rights. This is also indicated by the decision of the Administrative Court of Ansbach of May 3, 2024 (AN K 21.00653), which confirms a correspond-ing practice of the Bavarian supervisory authority (Bayerisches Landesamt für Datenschutzaufsicht).
Common to both court decisions is that they affirm the possibility of a waiver with effect for past processing operations, but at the same time emphasize that the core of effective legal enforce-ment must not be eliminated.

More critical voices from case law and supervision stand in contrast to this. For example, the Labor Court of Düsseldorf (judgment of March 5, 2020—9 Ca 6557/18) emphasized that data protection claims are not readily disposable. The European Data Protection Board (EDPB) takes the position in its Guidelines 01/2022 (Version 2.0, para. 166) that data subject rights may not be limited or restricted by contractual arrangements.

3. Practical tips

Practice tip #1: Companies should primarily use waiver clauses in settlements with departed employees and, in settlements with current employees, at most agree on narrowly defined, individualized clauses.

For practice, a clear differentiation between groups of individuals is initially recommended:

• Former employees: For terminated employment relationships and past data processing operations, the decisions of the OVG Saarland, the VG Ansbach, and the Bavarian supervisory authority suggest that a waiver of rights under Article 15 GDPR is currently well-justifiable. The prerequisite is that the employment relationship has actually been terminated at the time of concluding the settlement and that the clause is clearly limited to past data processing.
• Current employees: In the case of still-existing employment relationships, the power imbalance weighs more heavily; here the risk increases that a waiver will be regarded as involuntary or inappropriate and thus invalid. Moreover, in this case personal data continues to be processed, so that the benefit of a blanket retroactive clause is limited and the legal vulnerability is high.

Practice tip #2: Companies should formulate waivers so that they only cover past processing operations and leave data subject rights regarding future data processing unaffected.

The temporal scope of the clause is central to its data protection lawfulness and enforceability:

• Well-justifiable is the waiver of access requests regarding completed data processing during the terminated employment relationship, such as performance evaluations, bonus decisions, or internal communication during the terminated employment relationship.
• A waiver of future processing (e.g., to fulfill retention periods, to settle pension claims, or in later proceedings) is mostly viewed critically in case law and literature.

 Further practical tips:

Practice tip #3: Even though, according to OVG Saarland, a general settlement clause may suffice, data access rights under Article 15 GDPR should be expressly mentioned in waiver clauses (and with the temporal limitation to past processing described above). This can prevent data protection disputes from the outset.

 

Practice tip #4: Employers should document that the waiver clause was the subject of negotiations and that the data subject had the opportunity for legal advice. In corporate groups, a coordinated standard set of clauses and an internal "playbook" that HR and the legal department use as a common basis is recommended.

 

Practice tip #5: A waiver of other data subject rights under the GDPR (in addition to the right of access) increases the legal risk and should be avoided.