Managing Sensitive Information in Complaints

Last week, an employee came to me after reporting her manager for harassment - trusting HR to keep it confidential. Instead, HR passed the complaint to the manager's boss, who told the manager everything. By week's end, her manager had turned her words into a threat - and her job into a target. Here's what being a former corporate counsel taught me about HR's quietest, biggest lie: When HR says "This conversation is confidential," they mean: "Everything you say will be documented, distributed, and potentially used against you.” I've sat in those meetings. I've seen the reports. I've watched the aftermath. The truth? Your "confidential" conversation gets shared with: 1. Your direct manager 2. Their manager 3. Legal department 4. Executive team 5. Anyone deemed "relevant" to the investigation But it gets worse. Remember those "performance issues" that suddenly appeared after your complaint? That's because HR took your vulnerable moments and reframed them as evidence: "She admitted feeling anxious" becomes "Unable to handle workplace pressure" "He mentioned being distracted" turns into "Lack of focus and productivity" "They expressed concerns about the team" transforms to "Not a cultural fit" I've watched this playbook destroy careers for years. Now I'm helping employees protect themselves. Three rules I want you to remember: 1. Document everything BEFORE going to HR 2. Assume every word will be shared 3. Get things in writing - after any verbal conversation, send a follow-up: "As discussed today…" Protect yourself first. The company already has an entire department doing the same. Follow for more insider insights on protecting your workplace rights. #EmploymentAttorney  #CaliforniaEmploymentLaw  #EmployeeRights

DPDP Act Decoded #41: Data Principal Duties and Abusive Requests Most DPDP conversations stop at rights. Section 15 goes further. It imposes duties on Data Principals. Organisations will face impersonation, incomplete particulars, repeated complaints and misuse of rights mechanisms. The framework protects rights. It does not encourage misuse. 1. Data Principals have statutory duties Section 15 requires a Data Principal to: • comply with applicable laws while exercising rights • not impersonate another person • not suppress material information while providing data for State documents, identifiers, proof of identity or address • not register a false or frivolous grievance or complaint • furnish only verifiably authentic information while exercising correction or erasure rights On inquiry, the Board may impose a penalty up to ₹10,000 for breach of duties under Section 15. 2. Data Fiduciary accountability continues Section 8(1) makes the Data Fiduciary responsible for compliance, irrespective of any failure by the Data Principal to carry out duties. So an organisation cannot reject a request merely because the individual is inconvenient, angry, repetitive or difficult. Lawful compliance is not uncritical acceptance. 3. Classify the risk A defensible workflow should separate: • identity risk • authenticity risk • grievance abuse • genuine rights exercise For example: • If identity is not established, ask for required identifiers or particulars. • If correction or erasure is sought, require authentic information. • If a grievance appears false or frivolous, record reasons carefully. • If communication is abusive but the request is valid, process it through a controlled channel. • If the same issue repeats after reasoned closure, maintain an audit trail. Rule 14 matters. Publish the means to exercise rights and the particulars required to identify the Data Principal. Rule 9 adds discipline: every rights response should mention the DPO or authorised person’s business contact information. The key is disciplined classification, not emotional reaction. 4. The risk lies at both extremes Over rejection creates enforcement risk. Blind compliance creates operational, fraud and security risk. The Act does not require organisations to ignore impersonation, false information or frivolous complaints. 5. The 5 question filter for every request • Who is making the request? • Is the person identifiable? • Which right is being exercised? • Is supporting information authentic where required? • If action is refused, limited, delayed or closed, are reasons documented? Mature compliance will be judged by whether each request was handled lawfully, consistently and with evidence. Data Principal rights need access. Data Principal duties need verification. Data Fiduciaries need audit trails. #DPDPAct #DataProtectionIndia #PrivacyLaw #Compliance #DataFiduciary #DPDPA #DPDP

Are you handing your clients a loaded gun? You think you're helping. You uncover the risks. You spell out the exposures. You build the roadmap. You deliver the report. But did you know… If you submit that deliverable directly to your client without privilege, you may have just created evidence. Evidence that could hurt your client in court if they ignore your advice. Every risk report, every gap assessment, every mitigation roadmap that highlights material exposure should trigger one key question: "Should this be protected by attorney-client privilege?" Because if it isn’t, and the client doesn’t act, and that risk turns into a breach, guess what? -That beautiful, thorough, well-documented report of yours? -It's now discoverable. -It’s now a negligence roadmap & not a strategic asset. -And it might help sink the company you were hired to help. So, the question becomes ->When to use attorney-client privilege (and when not to)... Submit under privilege when: -The report identifies significant or unmitigated legal exposure -The roadmap includes recommendations the company may defer or reject -You’re documenting systemic failure or known gaps -You suspect the deliverable could become a litigation target down the road -You’re working with a client that moves slowly or inconsistently on security advice Deliver directly when: -You’re documenting completed remediations or status updates -You’re providing operational summaries, not legal or risk exposure -You’re sharing implementation plans, not risk-heavy findings -The advice has already been acted on and risk is mitigated When in doubt? -Loop in their attorney. -Route your engagement through counsel. -Submit the report to the client’s legal team, not the business owner or tech lead. This is basic professional hygiene for consultants who advise on risk. Especially when the stakes are high. Privilege ≠ paranoia Privilege = protecting your client from a future lawsuit & making sure your advice doesn’t become a liability when it’s ignored. Protect your work. Protect your client. #vCISO #CISO #MSP #risk

You’re working in People Ops at a mid-size tech company. You just rolled out a new AI-based performance review platform. It uses sentiment analysis, peer feedback, and productivity scores to help managers assess employee performance more “objectively.” But things take a turn. An employee files a complaint claiming the AI-generated feedback was biased and possibly discriminatory. They say the model flagged their performance inaccurately and they’re concerned it may be tied to race or gender. Your legal team is now involved, and leadership wants your help ensuring this doesn’t spiral. What’s your next move? First things guess, you’d freeze any further use of the AI review tool until an internal risk evaluation is done. Document the complaint, notify legal and your AI governance contact, and request logs or metadata from the tool to trace how the score was generated. Then, review the procurement and onboarding process of that AI tool. Was there a bias assessment done before rollout? Was HR trained on interpreting its outputs? If not, that’s a major gap in both governance and operational risk. Next, conduct a bias audit — either internally or with a third-party — to validate whether the tool is producing disparate impacts across protected groups. At the same time, inform your DPO (if applicable) to check if any personal or sensitive data was used beyond its intended scope. Lastly, you’d update internal policy: new tools affecting employment decisions must go through risk reviews, model documentation must be clear, and a human must always make final decisions with audit trails showing how they arrived there. #GRC

If you’ve never seen a claims file projected on a large screen in front of a jury, trust me. It changes how you write notes. Every email. Every internal comment. Every delay. Here’s a practical “file hygiene” checklist: 10 File Discipline Rules 1. Write notes as if a juror will read them. 2. Avoid sarcasm or frustration in writing. 3. Document every investigative step. 4. Confirm phone calls with follow-up emails. 5. Track response times. 6. Re-evaluate exposure after key events. 7. Clearly state coverage analysis. 8. Show efforts to obtain information. 9. Escalate potential excess cases early. 10. Close files with a summary memo. Good files tell a story of effort. Bad files tell a story of indifference. You don’t need perfection. You need documentation of reasonableness. If the file shows diligence, communication, and evaluation, you’ve already won half the battle. Control the narrative before someone else does it for you.

𝗦𝗼𝗺𝗲𝗼𝗻𝗲 𝗮𝗹𝘄𝗮𝘆𝘀 𝘄𝗮𝗻𝘁𝘀 𝘁𝗼 𝗸𝗻𝗼𝘄 𝘄𝗵𝗼 𝘀𝗮𝗶𝗱 𝗶𝘁. But that does not mean HR should tell them. One of the toughest situations in HR starts with a confidential conversation. An employee shares a concern. They ask to remain anonymous. The allegation appears credible. The investigation moves forward. Then leadership asks: "𝘞𝘩𝘰 𝘳𝘦𝘱𝘰𝘳𝘵𝘦𝘥 𝘵𝘩𝘪𝘴?" Now what? Many HR professionals learn this lesson the hard way: Confidentiality and anonymity are not the same thing. A few reminders worth saving: ▶️ 𝟭. 𝗡𝗲𝘃𝗲𝗿 𝗽𝗿𝗼𝗺𝗶𝘀𝗲 𝗮𝗯𝘀𝗼𝗹𝘂𝘁𝗲 𝗮𝗻𝗼𝗻𝘆𝗺𝗶𝘁𝘆. You may not be able to keep a name secret forever. What you can promise is that information will only be shared when necessary. ▶️ 𝟮. 𝗙𝗼𝗰𝘂𝘀 𝗼𝗻 𝗳𝗮𝗰𝘁𝘀, 𝗻𝗼𝘁 𝘁𝗵𝗲 𝘀𝗼𝘂𝗿𝗰𝗲. • The allegation matters. • The evidence matters. • The witness matters. But decisions should not depend solely on who raised the concern. ▶️ 𝟯. 𝗖𝗼𝗻𝘀𝗶𝗱𝗲𝗿 𝗿𝗲𝘁𝗮𝗹𝗶𝗮𝘁𝗶𝗼𝗻 𝗿𝗶𝘀𝗸 𝗲𝗮𝗿𝗹𝘆. If a complaint could lead to discipline or termination, think through how you will protect employees who participated in the process. ▶️ 𝟰. 𝗜𝗻𝘃𝗼𝗹𝘃𝗲 𝗹𝗲𝗴𝗮𝗹 𝗰𝗼𝘂𝗻𝘀𝗲𝗹 𝘄𝗵𝗲𝗻 𝗻𝗲𝗲𝗱𝗲𝗱. Especially when the complaint involves senior leaders, discrimination, harassment, or other high-risk issues. ▶️ 𝟱. 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁 𝘆𝗼𝘂𝗿 𝗿𝗲𝗮𝘀𝗼𝗻𝗶𝗻𝗴. If you decide to protect a source, document why. If you decide disclosure is necessary, document that too. The best HR professionals do not make these decisions based on pressure. They make them based on risk, fairness, and process. I've learned that many employees do not even want a specific outcome. They just want someone to listen. I've asked employees: "𝘞𝘩𝘢𝘵 𝘸𝘰𝘶𝘭𝘥 𝘺𝘰𝘶 𝘭𝘪𝘬𝘦 𝘵𝘰 𝘴𝘦𝘦 𝘩𝘢𝘱𝘱𝘦𝘯 𝘩𝘦𝘳𝘦?" More than once I've heard: "𝘏𝘰𝘯𝘦𝘴𝘵𝘭𝘺, 𝘐 𝘫𝘶𝘴𝘵 𝘸𝘢𝘯𝘵𝘦𝘥 𝘴𝘰𝘮𝘦𝘰𝘯𝘦 𝘵𝘰 𝘬𝘯𝘰𝘸." That answer taught me something important. People often speak up because they want to be heard. Not because they want revenge. 📌 Save this post for the next time confidentiality becomes a balancing act. What would you choose in this situation? (A) Refuse to identify the employee (B) Escalate to legal counsel (C) Identify the employee Please share your reasoning in the comments below. #HumanResources #EmployeeRelations #HRLeadership

Ever notice how certain people get labeled “difficult,” “too aggressive,” or “not a fit” — right after they start speaking up at work? Those labels often say less about the person and more about the discomfort their truth creates. It’s not always about what you did wrong — it’s about daring to challenge what’s wrong. That’s why I always emphasize creating a clear paper trail when raising concerns. Document your complaints in a legally protected way — specify the unlawful conduct (ie. 'gender' discrimination or opposing practices that could impact patient safety), and retain copies of every communication. This approach works. It compels accountability while engaging in protected activity — and if your employer retaliates, your documentation becomes powerful evidence supporting your retaliation claim. #employmentlaw #employmentlawyer #retaliation #lawyer #nyclawyer #njlawyer #whistleblower #workculture #workplace #employeerights

‘I am requesting access to ALL the personal data you hold about me.’ 13 words. That’s all it takes to ruin your week. This DSAR wasn’t made to access data. It was done for leverage. To exert power. And threaten, quietly. My job isn’t to decide what’s right or wrong. I just want to deal with it swiftly & efficiently - For my clients, for the requester & most importantly, for my soul. Here’s some hard earned wisdom. Save it, you’ll need it. → Rule #1: People are only entitled to their personal data. - Not other people’s data. - Not internal strategies or deliberations.  - Not an entire document that mentions their name. So if an email says:  ‘John isn’t great at deadlines.’ John has a right to that sentence. But if the email continues:  ‘Sarah and I will need to pick up the slack & the project might be delayed because of that.’ John does not have a right to that. And if the email says:  ‘Should we give John a warning or reassign some of his work?’ That’s an internal management discussion on how to handle him. John has no right to that either. 📌 If it’s a decision about them, they can see the result. If it’s HOW the decision was made - that’s internal. → Rule #2 You’re only required to do a reasonable search. Emily, a customer, wants ‘everything’ you have about her, including internal records. Where do you search? - Order history - Shipping details  - Complaint records  - Marketing CRM to see if she’s subscribed to your emails/loyalty programs Where do you NOT search? - Every email your employees have ever exchanged about her, unless you KNOW there’s something relevant in there  - Internal discussions about your marketing strategy, even if her name appears  - Deleted records 📌 You’re required to search intelligently, not exhaustively. If a search request is too costly, time consuming or doesn’t make sense, the courts will back you up. → Rule #3 If you suspect a DSAR is really just about gathering ammo for a lawsuit, be smart. Ryan suspects he’s being pushed out of a company. He submits a DSAR right before filing an unfair dismissal claim. What should you give him?  - His performance reviews, HR records etc. What should you withhold?  - Discussions about when to fire him, slack rants about how no one wants to work with him etc. 📌 Don’t get scared & disclose everything to ‘play it safe’. Comply, don’t overcomply. There, you’ve now dealt with a DSAR confidently. You can stand by it. And I? I'm going to get a drink. Or a nap. Or both.

In advance of new obligations under the Data (Use and Access) Act, the ICO has published some draft guidance on handling data subject complaints. This video breaks down some of the ICO's expectations in this area. As always, the ICO sets out three tiers: • "Must": Legal duties, for example, under UK GDPR or DPA 2018. • "Should": Good practice stuff that you should do unless there's a good reason not to. • "Could": Optional steps to help you comply. According to the ICO, core obligations include: • Giving people a way to complain directly to your organisation • Acknowledging complaints within 30 days (NOT one month, as with data subject rights) • Investigating the complaint and responding without undue delay • If the complaint was raised on the data subject's behalf, checking that the person has the authority to act for them. • Keeping records about the complaint while respecting data minimisation. The "shoulds" include publishing a clear complaints procedure, training staff to recognise complaints, and ensuring cover during absences. Special considerations apply for children, such as using child-friendly language and handling safeguarding concerns (if relevant). The ICO has long told data subjects that they must approach organisations first before coming to the regulator. This remains ICO policy only, as neither the UK GDPR nor DPA 2018 requires the data subject to do this. But the DUAA will codify this practice, and will give controllers new statutory duties around complaint handling. I would suggest reviewing your complaints with these new obligations in mind. Although—for whatever reason—it does not mention the DUAA at all, the ICO's draft guidance is probably a good place to start. The guidance is open for comments until 19 October. As always, feel free to get in touch if you need help implementing any of this.

Your HR case management system might be creating legal risk.  I’ve heard from more than a few General Counsels who were surprised to learn this: Many HR teams are managing workplace investigations inside tools designed for ticket resolution, not evidentiary preservation. That distinction matters. When access controls are broad, when audit trails are incomplete, or when documentation can be modified without clear traceability, you may be introducing risk you won’t see until litigation. If a system cannot clearly demonstrate what was changed, when, and by whom, the conversation shifts quickly from “what happened” to “what can be proven.” Employee Relations isn’t IT support. It’s risk management.  Most case management systems aren’t built for Employee Relations. HR Acuity is. It is designed to protect privilege and stand up to discovery because when litigation happens, documentation becomes a strategy.  If this is on your radar, I’d be more than happy to share why HR Acuity is built specifically to protect privilege and survive discovery. https://lnkd.in/ecnPnJrz #Discovery #Spoliation #LegalTech #EmployeeRelations