Waiver of data subject access requests through employment settlements

Key takeaways

• Waiving the future assertion of rights of access under Art. 15 GDPR is legally justifiable, particularly in the case of the mutual termination of employment relationships with effect for data processing in the past, but it is not completely risk-free under EU law.
• Waiver clauses vis-à-vis current employees or for future processing operations are significantly riskier and should – if at all – only be used in a very narrow and transparent manner.
• Companies should establish a standard set of clauses for settlement or termination agreements that explicitly address Art. 15 GDPR, only cover past processing operations, and are neatly embedded in DSAR and settlement processes.
  

1. Rights of access as a major challenge for companies

Requests for information under Article 15 GDPR from (former) employees create considerable workload for companies and tie up valuable resources. Particularly those cases that frequently arise in practice where (former) employees request information about "all their data" force companies to take extensive and costly measures - given the overbroad interpretation of the scope of Art. 15(3) GDPR and the right to request a copy by the CJEU. This often requires large email archives or extensive data sets (including company-internal communication) to be collected, filtered, searched, and, if necessary, redacted. A contractual exclusion of such rights to information is therefore highly relevant in practice. Nevertheless, it is still largely uncommon in practice to include data subject access requests in termination agreements or other settlement agreements. Although the legal discussion on the admissibility of a contractual waiver of access requests is still in its early stages, companies already have considerable leeway in this regard.

The starting point for the legal discussion is Article 15 GDPR, Article 8 CFR (fundamental right to data protection), the right to settle under labour law, and the limits of the dispositivity of data subjects' rights under EU law. Added to this are the – rather restrictive – guidelines of the supervisory authorities, in particular the European Data Protection Board (EDPB), which warns against the erosion of access rights through contractual agreements. Companies thus find themselves between procedural efficiency, the protection of fundamental rights, and inconsistent case law.

2. Current state of the dispute

In its ruling of May 13, 2025 (2 A 165/24), the Higher Administrative Court of Saarland decided that a comprehensive compensation clause in an employment court settlement can cover an asserted right to access under Art. 15 GDPR. The court qualifies the right to information as disposable and considers an effective waiver to be possible if the employment relationship has ended and the waiver is limited to past processing operations.

The Higher Administrative Court of Saarland interpreted the clause used ("all claims arising from the employment relationship and its termination, whether known or unknown, regardless of their legal basis") as also covering claims for data access under Article 15 GDPR. The decision of the Administrative Court of Ansbach of May 3, 2024 (AN K 21.00653), which confirms a corresponding practice of the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), also points in this direction.

What both court decisions have in common is that they affirm the possibility of a waiver with effect for past processing operations, but at the same time emphasize that the core of effective law enforcement must not be eliminated.
This is contrasted by more critical voices from case law and supervisory authorities. For example, the Düsseldorf Labor Court (judgment of March 5, 2020 – 9 Ca 6557/18) emphasized that data protection claims are not automatically discretionary. In its Guidelines 01/2020 (version 2.1, para. 166), the EDPB takes the position that the rights of data subjects may not be limited or restricted by contractual arrangements.

3. Practical tips

Practical tip #1: Companies should primarily use waiver clauses in settlements with former employees and, in settlements with current employees, agree only on narrowly defined, individualized clauses at most.

In practice, it is advisable to first make a clear distinction between different groups of people:

• Former employees: For terminated employment relationships and past processing operations, the decisions of the Higher Administrative Court of Saarland, the Administrative Court of Ansbach, and the Bavarian State Office for Data Protection Supervision indicate that waiving claims under Article 15 GDPR is currently justifiable. The prerequisite is that the employment relationship has actually ended at the time the settlement is concluded and that the clause is clearly limited to past data processing.
• Current employees: In the case of existing employment relationships, the power imbalance is more significant. Here, there is a greater risk that a waiver will be considered involuntary or unreasonable and therefore invalid. In addition, personal data continues to be processed in this case, so that the benefit of a general waiver clause for past data processing is limited and the legal vulnerability is high.

Practical tip #2: Companies should formulate waivers in such a way that they only cover past processing operations and the rights of data subjects with regard to future data processing remain unaffected.

The temporal scope of the clause is central to its lawfulness and enforceability under data protection law:

• It is justifiable to waive the right to information (or to contractually exclude this right) with regard to data processing that has been completed during the terminated employment relationship, such as performance evaluations, bonus decisions or internal communication.
• Waiving future processing (e.g., to comply with retention periods, to settle pension entitlements, or in subsequent proceedings) is viewed with skepticism in most case law and literature.

 Here are some more practical tips:

Practical tip #3: Even if, according to the Higher Administrative Court of Saarland, a general compensation clause may be sufficient, data protection rights to access under Art. 15 GDPR should be expressly mentioned in waiver clauses (and with the time limitation described above to past processing). This way, data protection disputes can be avoided from the outset.

 

Practical tip #4: Employers should document that the waiver clause was the subject of negotiations and that the data subject had the opportunity to seek legal advice. In corporations, it is advisable to have a standard set of settlement clauses and an internal "playbook" that HR and Legal can use as a common basis.

 

Practical tip #5: Waiving further rights of data subjects under the GDPR (in addition to the right to access) increases the legal risk and should be avoided.

 

4. Conclusion

A contractual waiver of data access rights pursuant to Art. 15 GDPR seems possible, particularly in the employment context. Such waivers can help companies to significantly reduce their “DSAR burden”.