Department For Education
This guidance is for people working in the education sector who respond to subject access requests (SARs).
You can make it easier to respond to a SAR by:
- having good record keeping practices, including retention periods
- making parents and carers aware of how they can find personal data they already have access to
- keeping an accurate record of how you have dealt with a SAR
Any individual whose personal data is held by an education setting can make a SAR.Personal data is information that relates to an identified or identifiable individual.
In this guidance the person making a SAR is referred to as the requester.
Individuals can ask for a SAR from anyone who works at an organisation. In a school this could include:
- teachers
- support staff
- school volunteers
Individuals can make a SAR in any format. They could make a verbal request, or a written request via a letter, text, or email. Once an individual has made a request, you cannot ask them to change the format they made the request in.
When an individual asks for their personal data, they do not have to call it a SAR. You will need to be aware that someone could be making a SAR if they:
- make a complaint
- quote other legislation, such as a freedom of information request
When working in an education setting you may receive a SAR from:
- students
- anyone with parental responsibility for a child (either for themselves or on behalf of the child)
- employees (such as teachers, classroom assistants and support staff)
- volunteers
- governors
- third parties, such as legal organisations, acting on behalf of another person
Information an individual can request
A requester can ask for any personal data that relates to:
- themselves
- someone they have parental responsibility for
- someone they have permission to act on behalf of
Examples of why someone might request a SAR
A requester may ask for specific personal information, such as attendance records, school reports or behaviour reports.
A former pupil could request access to their attendance records to prove they attended that school.
A parent could request to see their childs attendance records for a particular period.
A third party, such as a solicitor, could request special educational needs records for a child, on behalf of the childs parent.
Clarifying a SAR
Some requests will be non-specific and ask for all the information you hold.
You cannot ask the requester to narrow or reduce their request. You can ask for clarification of what specific information the requester is looking for.This might be helpful when the requester asks for a lot of information because they are not sure what they need.
Example
A college student has received a warning about their attendance. The student decides to submit a SAR. Theyre not sure what to ask for, so they ask for all the information the college holds on them.
The college replies with:
Dear student,
We hold a large quantity of personal data about you, including:
- your registration details
- your attendance information
- data about your courses
- coursework and examinations
- all correspondence you have received within 2 years
We can send you all this data, but if you want specific data then we may be able to retrieve it quicker. Please let us know if youd like specific information.
The student replies that they only need attendance information and internal communication relating to them.
The college has not asked the student to reduce their request. They have made it clear that the student can still have all the information they asked for.
The college should record evidence of the students clarification.
Encouraging requesters to self-serve
If the requester already has access to the information they want to see, you can direct them to this. For example, the requester may already have access to personal data stored on the schools website.
You do not have to treat this request as a SAR, provided they can access the information within one calendar month.
Example
A parent asks a school receptionist for their childs behaviour record. The receptionist refers them to the school website and provides them with sign-in details.
The parent can access their childs behaviour record and other personal data on the website. In this case, the parent has not asked for any information that is not already available to them. This request does not need to be treated as a SAR.
In most cases when an individual makes a SAR you will need to ask for identification (ID) from them.
In a school setting, pupils and their parents or carers are generally well-known to school staff. If you know the requester and are sure of their identity and authority, you do not have to request ID. Make a record of why you made this decision.
If the requester is asking for their own information, and you do not know them, then they will need to provide their identification.
Adults should provide a photo ID plus another form of ID, this could be:
- their driving license or passport for the photo ID
- a utility bill or council tax bill that confirms their name and address
If the requester is asking for another individuals information, then they will need to provide the individuals ID.
They will also need to provide evidence that they have the authority to act on the individuals behalf. This includes requesters such as parents and solicitors.
The data controller is responsible for deciding whether to request ID or not. Find out more about a data controllers responsibilities
Related Articles
Comments
Write a Comment
Ministerial Departmental News
- PM's Office, 10 Downing Street
- Cabinet Office
- Department for Business, Innovation and Skills
- Department for Communities and Local Government
- Department for Culture, Media and Sport
- Department for Education
- Department for Environment, Food and Rural Affairs
- Department for International Development
- Department for Transport
- Department for Work and Pensions
- Department of Energy and Climate Change
- Department of Health
- Foreign and Commonwealth Office
- HM Treasury
- Home Office
- Ministry of Defence
- Ministry of Justice
- Northern Ireland Office
- Scotland Office
- Wales Office
- See all departments