Education & School SAR Requests & Support...

Yes, we have extensive experience working with education-specific platforms such as CPOMS and similar systems. Our team understands the sensitive nature of the information these platforms hold, including safeguarding records and multi-agency communications. We apply specialist processes to extract, review, and redact data securely, ensuring compliance with UK GDPR and the Data (Use and Access) Act 2025. By combining intelligent automation with trained human oversight, we can handle this highly confidential content with the care it requires.

A subject access request (SAR) is a request to an organisation for a copy of your personal data. You can also use a SAR to ask about how your data is being used and shared.

The DUAA aligns the UK GDPR’s subject access provisions with existing guidance from the Information Commissioner’s Office (ICO). It formalises the “stop the clock” mechanism, allowing controllers to pause the response timeframe when additional information is needed from the data subject or to verify their identity.

In addition, the DUAA clarifies that controllers are only required to conduct a “reasonable and proportionate” search for information and personal data when responding to a subject access request. This reflects current case law, although the legislation does not define what constitutes a “reasonable and proportionate” search.

Notably, the DUAA does not adopt the DPDI Bill’s proposal to permit controllers to refuse subject access requests on the grounds of vexatiousness. Controllers must still demonstrate that a request is manifestly unfounded or excessive to justify refusal.

They also state ‘you should make reasonable efforts to find and retrieve the requested information. However, you are not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to the information. To determine whether searches may be unreasonable or disproportionate, you must consider:

• the circumstances of the request;
• any difficulties involved in finding the information; and
• the fundamental nature of the right of access.

The burden of proof is on you to be able to justify why a search is unreasonable or disproportionate.

Even where searching for certain information may be unreasonable or disproportionate, you must still search for any other information within the scope of a request. You should also consider whether further information from the individual will help you find the information they have requested. 

The ICO advises that, in most cases, you should avoid disclosing information about other individuals when responding to a Subject Access Request. However, there are times when the personal data being compiled is closely connected to someone else. In such situations, the focus should still be on releasing the personal data requested, but with careful consideration of the implications of disclosing information about third parties.

Before including third-party information, you should check whether you need their consent to share it. If consent cannot be obtained, consider whether it would be reasonable to provide the information without it. This decision must take into account any duty of confidentiality you owe to the third party and the sensitivity of the data involved. If neither consent nor reasonable disclosure is possible, redaction of the third party’s information may be required. The ICO emphasises the need to strike a balance – aiming to provide as much of the requester’s personal data as possible, while protecting the rights of others.

Pupil-based SARs often present additional challenges due to the nature of school records and the involvement of multiple parties. The ICO guidance notes: “The exemptions and restrictions that apply to other types of personal data also apply to education data. For example, if an educational record contains personal data relating to someone other than the requester (such as a family member), you must consider the rules about third-party data before disclosing it. However, you should not normally withhold information that identifies a teacher.” That said, there are circumstances where even this information may need to be withheld, depending on the context, potential risks, even the ownership structure of the institution.

Every case is different, which is why it’s important to get tailored advice. Why not get in touch with us? We can review your situation and provide clear, specific guidance on how to handle your SAR securely and compliantly.

The ICO state ‘The organisation you’re dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day they receive the request. If the organisation needs something from you to be able to deal with your request (eg ID documents), the time limit will begin once they have received this.

If your request is complex or you make more than one, the response time may be a maximum of three calendar months, starting from the day of receipt.’

• Expertise: Third-party providers specialise in handling subject access requests (SARs), ensuring compliance with privacy regulations (e.g., GDPR, CCPA).
• Efficiency: Outsourcing reduces the time and resources needed by internal teams, enabling quicker responses to requests.
• Cost Savings: Outsourcing can be more cost-effective than hiring and training in-house staff, especially for periodic or fluctuating SAR volumes.
• Scalability: External service providers can handle large volumes of requests during peak times, offering flexibility.
• Risk Mitigation: Third-party vendors such as Content Capture Services can help reduce the risk of non-compliance or mishandling of sensitive data, with established processes in place.
• Focus on Core Business: Delegating SAR processing allows internal teams to focus on core business functions, improving overall productivity.
• Data Security: Professional SAR handling services implement stringent data protection measures to ensure the confidentiality and security of personal data.

Yes, we can manage sensitive SARs that involve safeguarding issues with the utmost care and expertise. Our team is trained to identify and apply appropriate exemptions, including legal privilege exclusions and the ‘serious harm test’, to ensure that no information is disclosed which could put individuals at risk or breach confidentiality. We take a thorough, case-by-case approach to reviewing safeguarding records, combining our knowledge of data protection law with a deep understanding of the sensitive nature of these requests. This ensures compliance while protecting the welfare of pupils and others involved.