When your school receives a Subject Access Request, one of the most important questions you'll face is: what is redaction and how should we apply it? Redaction is the process of permanently removing or obscuring third-party personal information from documents before they are disclosed to the person making the request. It ensures that while an individual receives the personal data they're entitled to under the UK GDPR, you don't inadvertently breach the privacy rights of other pupils, parents, or staff members whose information appears in the same records.
Understanding what is redaction means recognising that it's both a legal requirement and a practical safeguard. Schools hold documents that frequently mention multiple people—incident reports, emails, meeting minutes, and pupil records often contain names, comments, or details about individuals other than the requestor. Proper redaction protects those third parties while fulfilling your duty to provide transparent access to personal data.
Why redaction matters in a subject access request
Subject Access Requests give individuals the right to see what personal data an organisation holds about them. However, this right is not absolute. Article 15 of the UK GDPR clarifies that the right of access should not adversely affect the rights and freedoms of others. In practical terms, this means if a document contains information about Person A (the requestor) and Person B (a third party), you must redact Person B's personal data before disclosing the document—unless an exemption applies or you have valid consent.
Failing to redact appropriately can lead to data breaches, complaints to the Information Commissioner's Office, and potential regulatory action. More importantly, it can damage trust between your school and its community. Parents expect that sensitive details about their child won't be casually disclosed in someone else's access request, and staff deserve the same privacy protections.
Redaction versus withholding
It's important to distinguish redaction from withholding an entire document. Redaction allows you to disclose most of a record while removing only the specific pieces of third-party data. Withholding, by contrast, means refusing to provide a document at all—typically because the personal data of the requestor is so intertwined with third-party information that meaningful redaction isn't possible, or because an exemption (such as legal professional privilege) applies. In most cases, redaction is the preferred approach because it maximises transparency while respecting privacy.
How to redact properly
Understanding what is redaction conceptually is one thing; executing it correctly is another. Schools must ensure that redactions are permanent and cannot be reversed or bypassed by the recipient.
Digital Documents
For PDFs, use a genuine redaction tool such as Adobe Acrobat Pro’s Redact function or a dedicated redaction application. Microsoft Word has no true redaction feature — "Mark as Final" is only a soft read-only flag, and the Document Inspector removes metadata rather than body text. Convert to PDF and redact there, or use the print-and-rescan method below. Simply highlighting text in black or using a digital marker pen is not secure—recipients can often copy the underlying text or remove the overlay. Proper redaction removes the text entirely from the file structure.
If you don't have access to professional redaction software, one safe method is to print the document, use a black marker to physically redact the information, then scan the page as a flattened image. This prevents any hidden data layers from remaining in the file.
Paper Documents
For hard-copy records, use a permanent black marker pen to obscure third-party names, addresses, or other identifying details. Ensure the ink is opaque enough that nothing shows through when photocopied. Never use correction fluid or sticky notes, as these can be removed or peeled back.
When redaction is required
Knowing when to redact is as important as knowing how. Here are typical situations schools encounter:
Incident reports: A report about a playground altercation may name multiple pupils. Redact the names and details of children other than the requestor.
Email chains: Staff emails often include comments about several pupils or parents. Redact third-party names, opinions, and any data not directly relevant to the requestor.
Meeting minutes: If a safeguarding or behaviour meeting discusses the requestor alongside other pupils, redact references to those other children.
Medical or SEND records: Reports from external professionals may mention siblings or peers. Redact their details unless they're essential context that directly relates to the requestor's own care.
Staff observations: Notes that mention staff opinions about other pupils or parents should be redacted unless the information is about the requestor.
Remember, the test is whether the information constitutes "personal data" about a third party. If it does, and no exemption applies, it should be redacted.
Exemptions and exceptions
There are limited circumstances where you may not need to redact third-party information, or where you may withhold information entirely:
Consent: If you have clear, informed consent from the third party to disclose their personal data, redaction may not be necessary. However, obtaining consent can be impractical or inappropriate in many school contexts.
Reasonable in all circumstances: If the disclosure of a third party's data is deemed reasonable—for example, the name of a staff member acting in an official capacity—redaction may not be required. This is a nuanced judgment and should be made carefully.
Statutory exemptions: GDPR provides exemptions for legal proceedings, safeguarding, and where disclosure would prejudice prevention or detection of crime. These are narrow and should be applied only with proper justification.
When in doubt, seek specialist advice. Professional SAR support services can help you navigate complex redaction decisions and ensure your approach is legally sound.
A step-by-step checklist
To ensure consistency and compliance across your school, adopt a clear redaction process:
Identify all documents: Gather every record that mentions the requestor.
Review each document: Read through carefully, noting where third-party personal data appears.
Determine what to redact: Apply the tests—does it relate to another identifiable individual? Is there a valid reason to disclose it?
Redact securely: Use appropriate software or physical methods to remove the data permanently.
Quality check: Have a second person review the redacted documents to catch anything missed.
Log your decisions: Document what was redacted and why, in case the decision is challenged later.
Disclose and explain: Provide the redacted documents to the requestor, and if appropriate, explain that some information has been removed to protect third-party privacy.
This systematic approach reduces the risk of accidental disclosure and demonstrates that your school takes data protection seriously.
Common mistakes
Even well-intentioned schools can make errors when redacting documents. Here are pitfalls to watch for:
Over-redaction: Removing too much information, including data that relates solely to the requestor, undermines the purpose of the access request and may breach your obligations.
Under-redaction: Leaving third-party names, addresses, or sensitive comments visible exposes your school to data breach liability.
Inconsistent methods: Using different redaction techniques across documents—some digital, some manual—can lead to gaps and errors.
Ignoring metadata: Digital files often contain hidden information in document properties, such as author names, edit histories, or comments. Strip metadata before disclosure.
Redacting staff names unnecessarily: Staff acting in their official capacity (e.g., a teacher's name on a report card) usually don't require redaction, though professional judgment and context matter.
Training and support
Redaction is a skill that requires training and practice. Not every member of staff will instinctively understand the legal boundaries or the technical methods. Schools should invest in regular training sessions that cover:
What personal data is and how to spot it in documents
When and how to apply redaction
The tools and techniques available for secure redaction
Case studies and worked examples relevant to the school environment
If your school lacks in-house expertise, consider partnering with external specialists who can provide guidance, quality assurance, and hands-on support during complex Subject Access Requests.
In summary
Redaction is a fundamental part of responding to Subject Access Requests lawfully and ethically. By understanding what is redaction, when it's required, and how to execute it properly, your school can balance transparency with the privacy rights of all individuals in your community. It's not always straightforward, and judgments will need to be made on a case-by-case basis, but with clear processes, appropriate tools, and access to expert advice, your school can meet its obligations confidently.
Whether you're handling your first SAR or refining your existing procedures, taking redaction seriously protects your pupils, staff, and your school's reputation. Don't leave it to chance—invest in the knowledge, training, and support you need to get it right every time.
