Schools and multi-academy trusts regularly receive subject access requests, and knowing how long to respond to a SAR is fundamental to compliance with the UK GDPR and Data Protection Act 2018. A late response can result in regulatory enforcement, reputational damage and legal challenge, making timely disclosure a priority for data protection officers, school business managers and senior leadership teams.
This guide explains the statutory deadline for subject access requests in educational settings, the limited circumstances under which extensions are permitted, the financial and operational penalties for late responses, and practical steps schools can take to meet their obligations consistently and efficiently.
The statutory one-month deadline
Under Article 12(3) UK GDPR, controllers must provide personal data to the requester without undue delay and in any event within one month of receipt of the request. The clock starts the day the school receives a valid SAR, whether submitted by email, letter, verbally, or through a parent portal.
The one-month period is calendar months, not working days. If the deadline falls on a weekend or bank holiday, the school may treat the next working day as the compliance date, though many organisations use midnight on the deadline day to avoid ambiguity.
For example, a SAR received on 5 September must be completed by 5 October. If 5 October is a Sunday, the school should aim to disclose by close of business on Friday 3 October or, at the latest, by Monday 6 October.
When the clock starts
The deadline begins when the school receives a valid request. If the requester's identity has not been verified, or if the request is insufficiently clear, the countdown does not begin until the school receives the necessary clarification. Schools may pause the clock by requesting additional information, but they must do so promptly and keep a record of the correspondence.
Extending the deadline
Article 12(3) UK GDPR permits a two-month extension only where the request is complex or the school has received multiple requests from the same individual. The extension is not automatic; the school must inform the requester within the original one-month period, explain why an extension is needed, and state the new deadline.
Complexity may arise where the request spans multiple years, involves several departments, or requires extensive redaction of third-party data (e.g. child protection records naming other pupils and staff). Volume alone—such as retrieving 10,000 emails—does not automatically justify an extension unless the scale creates genuine administrative difficulty.
Schools should document the reasons for any extension in writing and retain that justification in case of a later challenge. A bare assertion that the request is "complex" without evidence is unlikely to satisfy the Information Commissioner's Office (ICO) if a complaint is made.
What happens if you miss it
Failing to respond within the statutory period is a breach of Article 12(3) and may constitute a breach of the data subject's Article 15 rights. The consequences can be significant:
ICO enforcement action: The ICO can issue a reprimand, an enforcement notice requiring compliance within a specified period, or a fine of up to £8.7 million or 2% of annual turnover (whichever is greater) for Article 12 breaches, rising to £17.5 million or 4% for systemic failures under Article 15.
Court applications: Requesters may apply to the County Court for an order compelling disclosure. If the court finds that the school has unlawfully withheld data, it can order compliance and, in some cases, award damages for distress.
Regulatory censure: Schools inspected by Ofsted may face criticism if data protection failures are identified. Multi-academy trusts can attract scrutiny from the Education and Skills Funding Agency (ESFA) if systemic non-compliance is evident.
Reputational harm: Parents and staff quickly lose trust in schools that fail to respect data rights. A publicised enforcement notice or critical ICO decision notice can damage relationships and recruitment.
If you have already missed it
If a deadline has been missed, schools should disclose the data as soon as possible, apologise to the requester, and explain what steps are being taken to prevent recurrence. Proactive disclosure and a clear remediation plan are viewed more favourably by the ICO than silence or defensiveness.
Practical steps to stay inside the month
Meeting the one-month deadline consistently requires planning, resourcing and oversight. Schools that treat SARs as ad hoc exercises often struggle; those with clear processes rarely miss a deadline.
1. Designate a SAR Coordinator
A named individual—often the data protection officer or school business manager—should log all SARs, assign tasks, track progress and escalate delays. This role should have authority to request information from all departments and visibility of the school calendar to anticipate bottlenecks.
2. Maintain a SAR Register
Record the date of receipt, the requester's identity, the scope of the request, the deadline, any extension, the disclosure date, and any exemptions applied. This register provides audit evidence and helps identify patterns or recurring issues.
3. Use a Standard Acknowledgement Template
Acknowledge receipt within 48 hours, confirm the deadline, explain the verification process if identity is in doubt, and provide a contact name. Early acknowledgement reassures the requester and sets expectations.
4. Search Systematically
Identify all systems likely to hold the requester's data: the management information system (e.g. SIMS, Arbor), email accounts, SharePoint folders, safeguarding files, HR records, CCTV, and paper files. Involve IT support early to retrieve archived or deleted emails if necessary.
5. Redact Third-Party Data Carefully
Personal data about other individuals—pupils, staff, parents—must be redacted unless disclosure is reasonable and proportionate. Document each redaction decision, noting the exemption relied upon (e.g. Article 15(4) UK GDPR, Schedule 2 Part 3 of the Data Protection Act 2018).
6. Train Staff on SAR Procedures
All staff who handle data should know how to recognise a SAR, where to forward it, and the urgency of the deadline. Annual refresher training ensures consistency and reduces delays caused by misrouted requests.
Common pitfalls
Several recurring mistakes can cause schools to miss the deadline or provide incomplete responses:
Waiting for legal advice before starting: Legal input is valuable, but routine SARs should proceed in parallel. Start searching and collating data while awaiting advice on specific exemptions.
Underestimating the scope: A request for "all my emails" may yield thousands of records. Start early and allocate sufficient administrative time.
Over-redacting: Excessive redaction frustrates requesters and invites challenge. Apply exemptions narrowly and document your reasoning.
Ignoring holiday periods: Deadlines do not pause during school holidays. If a SAR arrives in July with an August deadline, assign responsibility to someone working through the break or complete the disclosure before term ends.
Failing to keep the requester informed: Silence breeds suspicion. Update the requester at least once mid-way through the process, especially if complications arise.
When to bring in specialist support
Complex SARs—particularly those involving child protection records, employment disputes, or litigation—benefit from specialist data protection advice. Schools working with E2E Education can access expert DPO guidance to navigate sensitive disclosures, apply exemptions correctly, and respond within the statutory deadline.
External support is especially valuable when:
The request spans multiple years or involves thousands of records
Third-party rights are engaged (e.g. other pupils named in safeguarding logs)
The requester is legally represented or the SAR forms part of litigation
The school lacks internal capacity or expertise to complete the response in time
Investing in professional support early can prevent costly errors, reduce staff stress, and ensure lawful, timely disclosure.
