A parent has asked for everything the school holds about their child. Somewhere in that file are safeguarding records. This is the request schools most often get wrong, and usually not through carelessness.
Start with whose data it is
A child's personal data belongs to the child. A parent making a request is either exercising the child's right on their behalf, or making their own request about themselves. Those are different things and produce different answers.
Then work through the exemptions
Three matter here in particular.
- Would disclosure be likely to cause serious harm to the child or another person?
- Does the record contain information provided by a third party in confidence?
- Is the parent the subject of an allegation within the record?
Each needs assessing against the specific document, not the file as a whole. A blanket refusal will not survive a complaint to the ICO.
Document every decision
The redaction itself matters less than the record of why. If the request escalates, what you will be asked for is your reasoning — and reconstructing it six months later is not realistic.
