Posted in:

Subject Access Requests (SAR)

A pupil, or someone acting on their behalf, may make a SAR in respect of personal data held about the pupil by a school. If the school is in England, Wales or Northern Ireland, the SAR should be dealt with by the school.

There are two distinct rights to information held about pupils by schools. They are:

  • the pupil’s right of subject access under the DPA; and SAR code of practice
  • the parent’s right of access to their child’s ‘educational record’ (in England, Wales and Northern Ireland this right of access is only relevant to maintained schools – not independent schools, English academies or free schools.

Although the SAR Code of Practice is only concerned with the right of subject access, it is important to understand what is meant by a pupil’s ‘educational record’. This is because there is an overlap between the two rights mentioned above, and also because ‘educational record’ is relevant when ascertaining the fee you may charge for responding to a SAR.

The law on educational records does not lie within the regulatory responsibilities of the Information Commissioner, but we refer to it here for completeness.

The statutory definition of ‘educational record’ differs between England and Wales, Scotland and Northern Ireland. Broadly speaking, however, the expression has a wide meaning and includes most information about current and past pupils that is processed by or on behalf of a school.

However, information kept by a teacher solely for their own use does not form part of the educational record. It is likely that most of the personal information a school holds about a particular pupil will form part of the pupil’s educational record.

However, it is possible that some of the information could fall outside the educational record; e.g. information about the pupil provided by the parent of another child is not part of the educational record.

Unlike the distinct right of access to the educational record, the right to make a SAR is the pupil’s right. Parents are only entitled to access information about their child by making a SAR if the child is unable to act on their own behalf or has given their consent.

For guidance about deciding whether a child is able to make their own SAR, see chapter 4 of the SAR Code of Practice. If it is not clear whether a requester has parental responsibility for the child or is acting on their behalf, you should clarify this before responding to the SAR.

In deciding what information to supply in response to a SAR, you need to have regard to the general principles about exemptions from subject access described elsewhere in this code.

Examples of information which (depending on the circumstances) it might be appropriate to withhold include:

  • information that might cause serious harm to the physical or mental health of the pupil or another individual;
  • information that would reveal that the child is at risk of abuse, where disclosure of that information would not be in the child’s best interests;
  • information contained in adoption and parental order records; and
  • certain information given to a court in proceedings concerning the child.

If a SAR is made for information containing, in whole or in part, a pupil’s ‘educational record’, a response must be provided within 15 school days. The maximum amount you may charge for dealing with the request depends on the number of pages of information to be supplied.

Please refer to the Information Commissioners Office (ICO) SAR Code of Practice for detailed guidance. You can also use the online ICO SAR checklist to help determine if/how to respond to a SAR https://ico.org.uk/for-organisations/subject-access-request-checklist/

If you are in any doubt please contact the Trust appointed Data Protection Officer (DPO) before responding to a SAR.