Data Subject Access Requests: what a school has to do

What a request is, and what it is not

Article 15 of the GDPR gives a person the right to a copy of their personal data, plus information about why it is processed, who it is shared with, how long it is kept and where it came from. In a school the requester is usually a parent exercising the right on behalf of a child, or a member of staff.

A request does not have to use the words "data subject access request", be on a form, be addressed to the right person, or explain why it is being made. An email to a class teacher saying "can I have everything you hold about my son" is a valid request and the clock has started. This is the single most common way schools lose two of their four weeks.

It covers more than the file. Emails about the pupil, notes of meetings, behaviour records, text and messaging exchanges where they are held by the school — if it is personal data about the requester and the school holds it, it is in scope wherever it lives.

The clock, and the extension most schools do not know about

The response is due without undue delay and within one month. Article 12(3) allows that to be extended by a further two months where the request is complex or where there are several requests — but only if you tell the requester within the first month, and tell them why.

That proviso is the whole value of the extension. A school that realises in week five that the request is bigger than it looked has lost the option. A school that writes a short note in week two saying the request is complex, invoking the extension and explaining why, has three months and a requester who knows where they stand.

Other people in the records

School records are rarely about one child only. An incident note names other pupils. A meeting minute records what another parent said. A teacher’s email discusses a class.

The requester is entitled to their own personal data, not to someone else’s. Where the two are mixed, the school either redacts the other person’s data or, where it is reasonable, seeks that person’s consent to release it. This is judgement work and it is why a DSAR takes real time — someone has to read every document rather than exporting a folder.

The common failure is the opposite of caution: releasing a full file quickly to seem cooperative, and disclosing a third party’s personal data in the process. That is its own breach, and it arrives on top of the original request.

The procedure to have written down

• A named recipient, and a rule that any member of staff who receives a request forwards it that day. Train for the email to the class teacher, because that is what will happen.
• A log: date received, what was asked for, what was done, date responded. This is the record that shows the school met its obligations.
• A step that identifies every system to search — MIS, email, shared drives, the paper file, messaging the school uses officially.
• A redaction step with a second reader for anything involving a third party.
• A decision point in the first two weeks on whether to invoke the extension.
• A response that includes the Article 15 information, not only the documents.

A school that has this written down handles a request as a process. A school that does not handles it as a crisis, in a week when three other things were already happening.