This guide explains what the DSAR management and negotiations exemption covers. It explains how to apply the right test to the right data, and how ProvePrivacy’s DSAR Redaction Tool keeps the three limbs clearly separated.
What is the DSAR management and negotiations exemption?
The DSAR management and negotiations exemption comprises three distinct carve-outs under the Data Protection Act 2018: management forecasting and planning, negotiations with the data subject, and corporate finance. Each has its own scope. Each has its own prejudice test.
What does the management forecasting and planning limb cover?
Personal data processed for management forecasting or planning is exempt from access rights to the extent that disclosure would be likely to prejudice the conduct of the business or activity concerned. This typically covers internal workforce planning data, such as restructuring projections. It excludes day-to-day HR records about individuals.
What does the negotiations limb cover?
Records of an organisation’s intentions in negotiations with the data subject are exempt to the extent that disclosure would be likely to prejudice those negotiations. This is a narrow, requester-specific exemption. It protects the organisation’s negotiating position with that individual during settlement discussions. It does not cover third-party negotiations.
What does the corporate finance limb cover?
Data processed for corporate finance services can be exempt where disclosure would reasonably be likely to affect the price of a financial instrument. It can also be exempt where disclosure would prejudice a corporate finance decision because of that price effect. This exemption protects market-sensitive information specifically. It does not protect general commercial confidentiality.
How do you apply the DSAR management and negotiations exemption correctly?
- Establish which limb the data relates to: forecasting, negotiations, or corporate finance.
- Apply that limb’s specific prejudice test with evidence, rather than generic commercial-sensitivity arguments.
- Redact only data meeting the test, leaving the rest disclosable.
The ICO expects each limb to be justified on its own specific test, with documented rationale.
What happens if the DSAR management and negotiations exemption is applied too broadly?
Over-applying exemptions exposes organisations to ICO complaints. The safer approach isolates specific data that genuinely meets the relevant prejudice test. The rest of the file is disclosed in the normal way.
A practical example of the DSAR management and negotiations exemption
Consider an employee raising a grievance who then submits a SAR while settlement talks are ongoing. The case file includes HR planning notes, internal settlement strategy documents, and routine HR correspondence.
The settlement strategy documents may fall under the negotiations limb, if disclosure would be likely to prejudice the organisation’s negotiating position. Routine HR correspondence about the grievance process does not qualify. It must be disclosed in the normal way.
If the same file also contains workforce restructuring projections unrelated to this individual, the forecasting and planning limb may apply separately. Each document needs its own limb-specific test. Applying one blanket “commercial sensitivity” label across the whole file would not survive an ICO complaint.
Frequently asked questions about the DSAR management and negotiations exemption
Can the DSAR management and negotiations exemption cover general HR records? No. The forecasting and planning limb covers workforce planning data, such as restructuring projections. It does not extend to day-to-day HR records about individuals.
Does the negotiations limb apply to third-party negotiations? No. It only protects the organisation’s negotiating position with the requester in settlement discussions with that individual. Negotiations with other parties are not covered.
Can commercial sensitivity alone justify the corporate finance limb? No. This limb protects market-sensitive information that could affect the price of a financial instrument. General commercial confidentiality is not enough on its own.
What is the biggest risk when applying these three limbs? Treating them as one generic “commercial” exemption. Each limb has its own scope and its own prejudice test, and each needs its own documented rationale.
Key takeaways on the DSAR management and negotiations exemption
- The exemption is really three separate limbs: forecasting and planning, negotiations, and corporate finance.
- Each limb has its own prejudice test — do not treat them as one generic “commercial” exemption.
- The negotiations limb protects only the organisation’s position with the requester, not third-party negotiations.
- The corporate finance limb protects market-sensitive information, not general commercial confidentiality.
- Redact document by document, with a documented rationale showing which limb was applied and why.
Why getting the DSAR management and negotiations exemption right matters
Getting this exemption wrong carries a cost in both directions. Under-redacting a settlement strategy document can hand a requester leverage in an active negotiation. Over-redacting routine HR correspondence, on the other hand, risks a valid ICO complaint and reputational damage.
A consistent, documented process protects the organisation either way. It shows the ICO that every redaction was tested against the correct limb, with real evidence rather than a generic label. That consistency matters most when finance and HR teams are handling requests separately, without a shared framework to work from. Training reviewers on all three limbs, not just the most familiar one, also reduces the risk of an inconsistent decision later being challenged.
Manual assessment vs a structured DSAR redaction tool
| Factor | Manual, ad hoc assessment | ProvePrivacy DSAR Redaction Tool |
|---|---|---|
| Distinguishing the three limbs | Easy to blur into one generic “commercial” exemption | Structured exemption library keeps each test separate |
| Evidencing the prejudice test | Rationale often undocumented | Documented decision and rationale per redaction |
| Consistency across finance and HR teams | Varies by who reviews the request | One consistent workflow across departments |
How does ProvePrivacy help with the DSAR management and negotiations exemption?
ProvePrivacy is the affordable GDPR compliance software built for data protection teams in resource-constrained, mid-market organisations. It’s a genuine OneTrust alternative, with all modules included and unlimited users.
Its DSAR management software includes a built-in DSAR Redaction Tool. It keeps forecasting, negotiations, and corporate finance exemptions clearly separated, with a documented rationale for every decision.
Book a demo today to see how ProvePrivacy’s RoPA, risk, incident and DSAR modules work together in one governed platform.