When I get a subject access request SAR I must respond correctly and within the statutory timeframe to comply with UK GDPR. Subject access requests are one of the most common data protection enquiries schools receive, yet many educational institutions still struggle to process them efficiently. Whether submitted by a parent seeking their child's records, a staff member requesting employment data, or a student accessing their own information, every SAR triggers a series of legal obligations that must be fulfilled accurately and on time.
Understanding your responsibilities is the first step to building a robust SAR process. This guide provides a practical, step-by-step framework tailored specifically for schools, helping you navigate verification, data retrieval, redaction, and timely disclosure while safeguarding the rights of all individuals involved.
Verify the requester’s identity first
Before disclosing any personal data, you must confirm that the requester is who they claim to be. Identity verification protects against unauthorised access and ensures data is only shared with the lawful recipient. For parents or legal guardians requesting a child's data, you should also verify parental responsibility, especially in cases involving separated parents or complex family arrangements.
Acceptable forms of identification include:
- Photographic ID such as a passport or driving licence
- Utility bills or official correspondence confirming address
- School records already on file that can corroborate identity
- For staff members, internal HR records or payroll documentation
If the request is ambiguous or lacks sufficient detail for you to locate the data, you are entitled to ask clarifying questions. However, do not use verification as a delay tactic—requests for additional information must be reasonable and proportionate.
Where the request concerns a child
When a SAR concerns a child, you must assess whether the child is competent to make the request themselves. The ICO points to around age twelve as a working threshold in England and Wales, but competence is judged individually rather than by birthday. If a child lacks sufficient maturity, a parent or guardian with parental responsibility may submit the request on their behalf. Always document your decision-making process in case of challenge.
Respond within one calendar month
The clock starts ticking the moment you receive a valid SAR. Under UK GDPR, you have one calendar month from the date of receipt to provide the requested information. If the request is complex or involves a large volume of data, you may extend this period by a further two months, but you must notify the requester of the extension and explain the reasons within the original one-month window.
Count the deadline carefully: one month means one calendar month from the day after receipt, not 30 days. For example, a request received on 15 September must be fulfilled by 15 October. If that date falls on a weekend or bank holiday, the deadline extends to the next working day.
Gather every relevant record across the school
Personal data can reside in many locations across a school environment. When I get a subject access request SAR I must search comprehensively across all systems, departments, and formats—both digital and paper-based. Common data sources include:
- Student information management systems (SIMS, Arbor, Bromcom, etc.)
- Email archives (staff and student accounts)
- Attendance and behaviour logs
- CCTV footage (if the requester is identifiable)
- Safeguarding and pastoral care records
- HR files (for staff SARs)
- Paper files stored in offices, filing cabinets, or off-site archives
- Third-party platforms used for learning or communication
Involve all relevant departments early. Liaise with IT, HR, safeguarding leads, and administrative staff to ensure no data source is overlooked. Incomplete responses can lead to complaints, repeat requests, and potential enforcement action by the Information Commissioner's Office (ICO).
Redact third-party data properly
Not all information held in school records can be disclosed. You must redact personal data relating to third parties unless:
- The third party has consented to disclosure, or
- It is reasonable to disclose without consent (considering the third party's rights and interests)
For example, if a parent's SAR for their child's records includes emails mentioning other pupils by name, those names should usually be redacted. However, context matters: if removing third-party data would render the remaining information meaningless or misleading, you may need to disclose more than you initially anticipated, balancing transparency with privacy.
Professional judgment is required. In cases of doubt, consult your Data Protection Officer or legal advisor. Incorrect redaction can expose the school to liability, while excessive redaction may breach the requester's rights.
Exemptions worth knowing
Certain data may be withheld under specific exemptions, including:
- Legal professional privilege
- Information that would prejudice the prevention or detection of crime
- Data subject to confidentiality obligations (e.g., references given in confidence)
- Exam scripts and marks during certain periods
Document your reasons for applying any exemption. Transparency promotes trust and makes any subsequent complaint easier to defend.
Provide the information in a usable format
When I get a subject access request SAR I must provide the data in a concise, intelligible, and easily accessible form. This typically means:
- Supplying a structured document or folder, not a random data dump
- Using plain English explanations where technical terms or codes appear
- Providing data electronically (e.g., PDF or secure download link) unless the requester specifies otherwise
- Including a cover letter explaining what has been provided, any redactions, and the requester's rights
If you hold CCTV footage, provide a copy on a USB drive or secure cloud link. If data exists only on paper, scan and compile it digitally where feasible. The goal is to make the information as usable as possible without imposing undue burden on the school.
No fee, with one narrow exception
SARs are generally free of charge. You cannot levy an administrative fee simply because processing the request requires staff time. However, if a request is manifestly unfounded or excessive—for example, a repeat request for identical data without justification, or a request clearly intended to cause disruption—you may either charge a reasonable fee or refuse to act. You must be able to demonstrate why the request meets this high threshold, and you should inform the requester of their right to complain to the ICO and seek judicial remedy.
Keep a record of how you handled it
When I get a subject access request SAR I must document each stage of the process for accountability and continuous improvement. Keep records of:
- The date and method of receipt
- Identity verification steps and outcomes
- Data sources searched and data retrieved
- Redactions applied and reasons
- Communication with the requester
- The final response and method of delivery
Good record-keeping supports your compliance posture, assists with internal audits, and provides evidence in the event of a dispute or investigation. It also helps identify bottlenecks and inefficiencies, enabling you to refine your SAR procedures over time.
Train staff and agree an internal route
SAR compliance is a whole-school responsibility. Ensure that all staff who handle personal data understand what a SAR is, how to recognise one, and what to do when they receive one. Requests can arrive by email, letter, or even verbally, and may not use the phrase "subject access request" explicitly.
Develop a clear escalation process: designate a SAR coordinator or team responsible for coordinating responses, and ensure all departments know how to report incoming requests promptly. Regular training and simulation exercises can help embed good practice and reduce the risk of non-compliance.
When I get a subject access request SAR I must treat it as a priority, not an inconvenience. Embedding a culture of transparency and respect for data rights will strengthen your school's reputation and build trust with parents, pupils, and staff alike.
