We provide the complete commercial debt recovery service; from outsourced early arrears collections through to expert litigation, all handled in-house by a multi-award-winning law firm.

 

Visit our debt recovery website

How to deal with and respond to a subject access request (SAR) for information about a child.

The ICO provides useful, detailed guidance on SARs.

What are individuals entitled to?

Under the right of access, an individual is only entitled to their own personal data. They are not entitled to information
relating to other people, unless:

  • their data also relates to other individuals; or
  • they are exercising another individual’s right of access on their behalf (for example, a parent making a request on
    behalf of their child).

Please note, a parent making a request for educational records may not necessarily be a SAR. Therefore it is important that you correctly differentiate between the two. Our advice note on dealing with requests for educational records can be accessed here: https://flintbishop.co.uk/insights/education-data-ensuring-best-practice/

The following steps outline the process that should be followed when dealing with a SAR to ensure compliance with the law.

Step 1: Recognising a request

A SAR can be made verbally or in writing, including on social media. A request is valid if it is clear that the individual is asking for their own personal data. This means an individual would not need to refer to the DPA or direct the request to a specific contact, for their request to be valid.

Step 2: Diarising the final date to respond

You must comply with a SAR without undue delay and at the latest within one month of receiving the request. In some cases, where the request is complex, you can extend the time to respond by a further two months, but you should only do this if it is absolutely necessary.

You should start the process of responding as soon as you can but also make a note of and diarise the long-stop date, so that it is not missed. If you fail to respond within the required timeframe, you will be in breach of the law.

Step 3: What to consider before replying

Before responding to a SAR for information held about a child, you should consider whether the child is mature enough to understand their rights. If the request is from a child and you are confident that they can understand their rights, you should usually respond directly to the child. You may, however, allow the parent or guardian to exercise the child’s rights on their behalf if the child authorises this, or if it is evident that this is in the best interests of the child.

When dealing with a SAR for information about a child that has come from a parent or carer, you should consider the following before responding:

  • the child’s level of maturity;
  • the nature of the personal data;
  • court orders relating to parental access or responsibility;
  • whether there is a duty of confidence owed to the child;
  • allegations of abuse or ill treatment;
  • whether there would be any detriment to the child if the information about them is disclosed to a parent or carer (or even, withheld from the parent or carer); and
  • what the child’s views are on the disclosure of their personal data.

Step 4: Compiling the response

Once you have had made a decision on whether or not you will disclose the personal data (or some of it) to the parent or carer making the request, you should record that decision (explaining your reasons for reaching it) and also communicate your response to the parent or carer.

When making a disclosure of personal information (whether disclosure is made to the parent or carer or, directly to the pupil), your SAR response should include a description of the following:

  • what personal data the school holds about the child;
  • how the school processes it;
  • how long the data is kept;
  • what is being disclosed;
  • whether any personal information is being withheld from disclosure; and
  • details of the pupil’s right to complain.

You should take care to ensure that you are providing the information in a clear, transparent and accessible manner (particularly when responding to a young person directly).

Care should be taken to ensure the information can be understood and that plain language is used.

If you need assistance with responding to a subject access request or any other data protection matter, contact our Commercial team on 01332 226 466 or fill in the form below.

SHARE

Share

Scroll to next section

Scroll back to the top

Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.

For more information on how these cookies work, please refer to our Cookies Policy.

Strictly necessary cookies

Necessary cookies enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, but this may affect how the website functions.

Analytics Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our website. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous.

Force24 cookies & tracking

This website utilises Force24’s marketing automation platform. Force24 cookies are first-party cookies and are enabled at the point of cookie acceptance on this website. The cookies are named below:

F24_autoID
F24_personID

They allow us to understand our audience engagement thus allowing better optimisation of marketing activity.