Skip to content ↓

Subject Access Requests

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them. This includes:

  • Confirmation that their personal data is being processed

  • Access to a copy of the data

  • The purposes of the data processing

  • The categories of personal data concerned

  • Who the data has been, or will be, shared with

  • How long the data will be stored for, or if this isn’t possible, the criteria used to determine this period

  • Where relevant, the existence of the right to request rectification, erasure or restriction, or to object to such processing

  • The right to lodge a complaint with the ICO or another supervisory authority

  • The source of the data, if not the individual

  • Whether any automated decision-making is being applied to their data, and what the significance and consequences of this might be for the individual

  • The safeguards provided if the data is being transferred internationally

Subject access requests can be submitted in any form, but we may be able to respond to requests more quickly if they are made in writing and include:

  • Name of individual

  • Correspondence address

  • Contact number and email address

  • Details of the information requested

Children and subject access requests

Personal data about a child belongs to that child, and not the child's parents or carers. For a parent or carer to make a subject access request with respect to their child, the child must either be unable to understand their rights and the implications of a subject access request, or have given their consent.

Children below the age of 12 are generally not regarded to be mature enough to understand their rights and the implications of a subject access request. Therefore, most subject access requests from parents or carers of pupils at our school may be granted without the express permission of the pupil. This is not a rule and a pupil’s ability to understand their rights will always be judged on a case-by-case basis.

Responding to subject access requests

When responding to requests, we: 

  • May ask the individual to provide 2 forms of identification

  • May contact the individual via phone to confirm the request was made 

  • Will respond without delay and within 1 month of receipt of the request (or receipt of the additional information needed to confirm identity, where relevant)

  • Will provide the information free of charge

  • May tell the individual we will comply within 3 months of receipt of the request, where a request is complex or numerous. We will inform the individual of this within 1 month, and explain why the extension is necessary

We may not disclose information for a variety of reasons, such as if it:

  • Might cause serious harm to the physical or mental health of the pupil or another individual

  • Would reveal that the child is being or has been abused, or is at risk of abuse, where the disclosure of that information would not be in the child’s best interests

  • Would include another person’s personal data that we can’t reasonably anonymise, and we don’t have the other person’s consent and it would be unreasonable to proceed without it

  • Is part of certain sensitive documents, such as those related to crime, immigration, legal proceedings or legal professional privilege, management forecasts, negotiations, confidential references, or exam scripts

If the request is unfounded or excessive, we may refuse to act on it, or charge a reasonable fee to cover administrative costs. We will take into account whether the request is repetitive in nature when making this decision.

When we refuse a request, we will tell the individual why, and tell them they have the right to complain to the ICO or they can seek to enforce their subject access right through the courts.

Other data protection rights of the individual

Individuals also have the right to:

  • Withdraw their consent to processing at any time

  • Ask us to rectify, erase or restrict processing of their personal data (in certain circumstances)

  • Prevent use of their personal data for direct marketing

  • Object to processing which has been justified on the basis of public interest, official authority or legitimate interests

  • Challenge decisions based solely on automated decision making or profiling (i.e. making decisions or evaluating certain things about an individual based on their personal data with no human involvement)

  • Be notified of a data breach (in certain circumstances)

  • Make a complaint to the ICO

  • Ask for their personal data to be transferred to a third party in a structured, commonly used and machine-readable format (in certain circumstances)

Individuals should submit any request to exercise these rights to the DPO. If staff receive such a request, they must immediately forward it to the DPO.

Parental requests to see the educational record

Parents, or those with parental responsibility, have a legal right to free access to their child’s educational record (which includes most information about a pupil) within 15 school days of receipt of a written request.

If the request is for a copy of the educational record, the school may charge a fee to cover the cost of supplying it.

This right applies as long as the pupil concerned is aged under 18.

There are certain circumstances in which this right can be denied, such as if releasing the information might cause serious harm to the physical or mental health of the pupil or another individual, or if it would mean releasing exam marks before they are officially announced