GovWire

You can receive an information rights request relating to personal data either verbally or in writing, including through social media.

Unless theres a valid reason, you must respond to an information rights request within one calendar month. If the case is complex you can extend the response deadline by an extra 2 calendar months.

Information rights requests only apply to the personal data you hold when you get the request.

Your school should have procedures in place for responding to information rights requests. You should also make sure that all staff are trained to recognise different kinds of information rights request and know how to escalate a request if they receive one.

You may get subject access requests from:

• a parent or carer wishing to see what data you hold about themselves or their child
• a pupil wishing to see their educational record or a breakdown of their exam marks and the markers comments
• staff
• former staff or pupils
• a solicitor on behalf of a pupil, parent or carer

Before responding to a subject access request raised by a parent or carer about a child, check if:

• the requester has parental responsibility for the child
• the child is aged 13 or older and has given their consent for a parent or carer to act on their behalf
• releasing the information to an absent parent or carer would cause the child distress or result in safeguarding concerns

You should not provide a pupils educational record to a parent or carer if there is a court order in place that limits the exercise of their parental responsibility.

Most of the personal data you hold about a pupil will form part of their educational record. For maintained schools, a request for an educational record is different from a subject access request.

The Information Commissioners Office has more information about accessing pupils information. This includes guidance on making requests for viewing a childs educational record.

You must respond to a subject access request within one calendar month.

Maintained schools must make sure that a parent or carer can access their childs educational record within 15 school days of receiving their written request. If theyve asked for a copy of the record, you can charge a fee, but this must not be more than it costs you to supply.

If you receive a subject access request, follow these steps before you respond.

1. Log the request.

2. Check if the request is from a parent or carer to see their childs educational record request. Maintained schools have a shorter timescale for responding to these.

3. Check the identity of the requester and their right to request the data. If the parent or carer is making the request on behalf of a pupil aged 13 or over, check they have consent.

4. Make sure it is clear from the request exactly what personal data the individual wants. Ask for clarification if you need to.

5. Acknowledge youve received the subject access request as soon as possible. Tell them when youll send the response.

6. Consider if the subject access request is complex. If you need another 2 months to produce the information, make sure youve told the requester within one month of receiving the request. You must explain why you need the extra 2 months.

7. Before you send over any data, check if any information in the files needs to be redacted for example, if it refers to other pupils or parents.

8. Send the final response and securely transfer the requested information to the individual.

Keep a record of any subject access requests, including:

• the request itself
• the date you received it
• all correspondence relating to the request (you should not keep personal documents used to confirm identity)
• what you provided
• when you provided it
• confirmation that the requester received the data in question
• details of your decision-making rationale in case of challenges

The Information Commissioners Office has a 