Employer secretly used VPN data to monitor me after I raised a grievance. DPO acknowledged the gap but won't admit a breach.

I recently joined a corporate role and things went downhill pretty fast. After I raised a grievance, my employer started conducting probationary reviews and pulling me up on timekeeping. That in itself might not sound unusual, but what caught my attention was how they were doing it.

I made a SAR and discovered that HR had requested my VPN login data. The dates on the records make it clear this only started after I raised my grievance. They then tried to pass it off as evidence of "timekeeping concerns" as part of what honestly feels like a managed exit.

The thing is, their data processing notice says nothing about VPN data being used for monitoring or timekeeping. I flagged this with the DPO, and to their credit they acknowledged the gap. They said the processing notice didn't cover that use and that they'd be sending a reminder out to all HR managers. But they wouldn't go as far as accepting that any data protection law had actually been broken.

What really got me though is that the grievance outcome said timekeeping would continue to be monitored. So they're essentially carrying on with a practice they've already acknowledged wasn't properly covered in their own privacy notice.

A few questions for anyone who's dealt with something similar:

1. If the DPO acknowledged the processing notice didn't cover this use, isn't that basically conceding a transparency breach under Articles 13/14 UK GDPR?
2. Does the fact that VPN data was only pulled after I raised a grievance help build a case that this was retaliatory rather than genuine management?
3. Can they really keep monitoring me this way just because they've now sent a reminder to HR, without actually updating the notice or getting consent?
4. Has anyone successfully challenged this sort of thing where an employer tries to retrospectively justify covert monitoring?

I've already been through the internal grievance process and got nowhere, so I'm weighing up my options.