What is a subject access request?

Anyone can make a subject access request, including pupils, parents, carers and staff. A request can be made verbally or in writing, including by email or social media, and it does not have to use any particular words or be sent to a particular person. That means every member of staff needs to recognise a request and pass it on quickly.

You must respond without undue delay and within one month. If the request is complex, or the same person has made several requests, you can extend by up to two further months, but you must tell them within the first month and explain why. The clock pauses while you wait for proof of identity or clarification you reasonably need. You should make a reasonable and proportionate search, and you usually cannot charge a fee. There are no special allowances for school holidays.

Children have their own right of access. If a child is mature enough to understand their rights, you should usually respond to them directly. A parent can ask on behalf of a child who is not, as long as that is in the child’s best interests. Information about other people, such as third parties in safeguarding records, may need to be withheld or redacted.

Why it matters for your setting

• Families in dispute, or going through complaints or tribunals, often use SARs, so be ready.
• Well-organised records make it much faster to find and review everything held about a person.
• Missing the deadline can lead to complaints to the Information Commissioner’s Office (ICO).

How PupilDB helps

Because PupilDB keeps each pupil’s details, medical notes, contacts and attendance in one record, it is easier to find the information a request covers.