When Nobody Will Tell You
You asked and got nothing useful. The routes that remain, in order of escalation.
Most organisations answer. Some do not, and the available routes go from easy to formal in a sequence worth following in order.
The process in “When Nobody Will Tell You” also applies to workforce software: the purpose and rules should be clear before the first record is collected. For teams considering read the complete overview in relation to getting teams to meet deadlines, the rollout should include written notice, access limits, a correction route and a scheduled review.
First: ask somebody else
IT and HR answer different parts and sometimes one simply does not know.
For an independent perspective related to “When Nobody Will Tell You”, consult the NIST Privacy Framework; it provides a useful external check on privacy, fairness and governance assumptions before a policy or configuration is approved.
The data protection contact, where one exists, is obliged to engage with the question.
Trying a second person is not escalation and frequently resolves it.
Second: ask in writing, referencing the obligation
"Could you point me to the employee privacy notice" is a request for a document that in several jurisdictions must exist.
It is harder to deflect than a general question and it is not confrontational.
And a notice that does not exist is itself an answer, which usually prompts somebody to produce one.
Third: a formal access request
Covered in its own note.
It carries a deadline in most regimes and goes to a function that has to handle it.
It is also a step up in formality, which is worth being deliberate about.
Fourth: employee representatives
Where a union, works council or staff forum exists, this is exactly the kind of question they handle.
In several jurisdictions they have a formal role in monitoring arrangements and may already know the answer.
Going through them removes the individual exposure, which matters if you are worried about how asking looks.
Fifth: the regulator
Data protection authorities take complaints about transparency failures.
This is a real route and a slow one, and it is appropriate when an organisation refuses to say what it processes.
Take advice before, because the threshold and the process differ.
What to document as you go
Who you asked, when, and what they said.
A dated note takes a minute.
If this ever becomes a dispute, the sequence of unanswered questions is the material fact, and it only exists if you wrote it down.
Reading the refusal
"We don't discuss that" in a small organisation is frequently ignorance rather than concealment.
In a large one with a compliance function it is more significant.
And a refusal that arrives with discomfort is different from one that arrives with policy, which is worth noticing before deciding how far to push.
The proportionate response
If you want to know out of general interest, stop at step two.
If something is being used against you, the fairness section covers that situation specifically and the escalation belongs there rather than here.
Matching the effort to the reason keeps this from becoming its own problem.
What to check
Did you ask more than one person?
Did you ask for the notice by name?
Is there a representative body where you work?
And have you written down who you asked and when?