The Request Clock
One request, fourteen things the search turned up, and a call on each. The trap is that both directions are a breach: withhold what is hers and you fail her, disclose what is someone else's and you fail them.
1. An internal e-mail thread about the requester's complaint, in which two named managers give their opinions of how she handled a client.
2. A spreadsheet of the whole team's absence records, one row of which is the requester's.
3. Your legal team's advice on whether her grievance is likely to succeed.
4. A recording of an all-hands meeting she attended, in which she does not speak and appears only in a wide shot.
5. A draft performance review, never finalised, never shared with her.
6. Her manager's private notebook, kept at home, with a page of notes about her from a one-to-one.
7. CCTV of the reception area during her shift, showing eleven other identifiable people.
8. An ongoing internal fraud investigation naming her as a subject, where disclosure now would let her align her account with the evidence.
9. A pseudonymised analytics export in which her behaviour appears under a hashed user id you can still resolve.
10. Aggregate engagement statistics for her department: 62% completion, forty-one staff.
11. Her salary, alongside the salaries of two colleagues doing the same job, in a pay-review paper prepared for the committee.
12. Every e-mail in the organisation that merely mentions her name in a distribution list.
13. A whistleblowing report about her conduct, submitted by a named colleague who asked to stay anonymous.
14. A restructure plan, not yet announced, listing her role as at risk. Telling her today would cut across the consultation the law requires you to run properly.
15. A backup tape of the mail server, restorable only at significant cost and containing, among everything else, her mailbox.
Answers follow GDPR / UK GDPR practice — the third-party balancing in Article 15(4), legal professional privilege and the crime-prevention exemption. Educational, and not legal advice: the close calls belong to your own DPO and regulator, and every exemption you rely on should be recorded with the reason and the reviewer.