Handling education data

What is education data?

Under the Data Protection Act 2018 (DPA) ‘education data’ is defined as personal data that consists of information that forms part of an educational record, and is not data concerning health.

This covers most information about current and past pupils that is processed by or on behalf of a school and applies to nearly all schools including maintained schools, independent schools and academies.

Although most personal information a school holds about pupils is likely to form part of their educational records, the following are examples of information that would not fall within these records:

• information kept by a teacher solely for their own use; and
• information that a parent of another child provides about the pupil.

How can individuals access education data?

There are two ways in which information held about pupils can be accessed:

1. the pupil’s right of access under the DPA (commonly known as a subject access request or SAR);
2. the parent’s right of access to their child’s ‘educational record’. In England, Wales and Northern Ireland, this right of access is only relevant to maintained schools (including all grant-aided schools in Northern Ireland) not independent schools, academies or free schools. However, in Scotland, the right extends to all schools.

It is important to note the following differences between these rights:

• a parent’s right to access their child’s educational records only allows them the right to access their child’s educational record. In contrast, a subject access request also provides access to the personal data a school holds that does not fall within the definition of an educational record;
• the two rights also have different time limits for compliance. You must respond to a parent’s right of access to their child’s educational records within 15 school days, whereas you must (in most cases) comply with a subject access request within one month; and
• unlike the parent’s right of access to their child’s educational record, it is the pupil’s right to make a subject access request. Parents can only submit a subject access request for information about their child if the child is not competent to act on their own behalf or has given their consent.

Is education data ever exempt from subject access?

If an educational record contains personal data relating to someone other than the requester (such as a family member), you must consider the rules about third-party data under the DPA before disclosing it. The ICO has provided some useful guidance on this issue that can be accessed here.

You should not normally withhold information that identifies a teacher.

You are also exempt from providing education data in response to a subject access request if the education data is supplied in a report, or given as evidence to the court in the course of proceedings and separate rules apply to those proceedings that allow the withholding of the data from the individual it relates to.

In most circumstances, you are also exempt from providing education data in response to a subject access request to the extent that complying with the request would be likely to cause serious harm to the physical or mental health of any individual (for example, there is a safeguarding issue).

Key points

Ensure your staff understands the difference between a subject access request and a right of access to educational records.

• Ensure you comply with the request in the appropriate timescales.
• Consider the ICO’s guidance on what to include in a response before sharing any data.