How to handle a subject access request in an independent school

A subject access request does not need to use those words, mention the law or arrive in writing. A parent asking the receptionist for "everything you've got on us", an email to a housemaster, a message through the parent portal or a comment on the school's social media can all be valid requests, and the one-month clock starts on the day that any member of staff receives it.

This is why the most important control is a simple one. Every member of staff (including teachers, matrons, coaches and the bursary team) should know that a request for personal information goes straight to one named person, usually the Data Protection Lead or the school's Data Protection Officer (DPO). Requests that sit in a housemaster's inbox over half term are one of the easiest ways for a school to miss the deadline.

Record the date of receipt, who made the request, who it was made to and exactly what was asked for, then acknowledge it in writing. The deadline is one calendar month from the day of receipt, so a request received on 3 March is due on 3 April. If the corresponding date does not exist (a request received on 31 August), the deadline is the last day of the following month, 30 September.

School holidays do not pause the clock. If a request lands in the last week of the summer term, it is due in August whether or not the people who hold the information are on site, so plan the search before staff leave. Where a request is complex, or the same person has made several requests, you can extend the deadline by up to two further months, but you must tell the requester within the first month and explain why.

Ask for proof of identity only where you have a genuine doubt. A parent the school has dealt with for five years, writing from the email address on file, rarely needs to send a passport. Where you do need it, ask promptly: the clock does not start until you receive it.

The harder question in a school is whose data is being requested. A pupil's personal data belongs to the pupil, not to their parents, even when the parents pay the fees. Where a child is mature enough to understand their rights, the request is theirs to make, and a parent should normally have the child's consent or be acting in the child's best interests before you respond to them. The law in England and Wales sets no fixed age for this (Scotland presumes that a child of 12 or over has the capacity), but many schools treat 12 as a starting point for a judgement about the individual pupil rather than a rule.

Separated parents need particular care. Each parent with parental responsibility can usually act for a child who cannot exercise their own rights, but check whether any court order limits what either parent may receive, and remember that the pupil file may contain the other parent's address, correspondence and personal circumstances. A request from a solicitor should come with written authority from the person whose data it is (or, for a younger child, from someone with parental responsibility).

Since 5 February 2026, the Data (Use and Access) Act 2025 has put the "stop the clock" rule on a statutory footing in a new Article 12A of the UK GDPR. If you genuinely cannot respond without more information, you can ask the requester to clarify (which period, which member of staff, which incident) and the deadline pauses until they reply.

This is a tool for requests you cannot answer, not a way to buy time. A request for "all emails about my son since he joined in Year 7" is broad but perfectly clear, so it would be hard to justify pausing the deadline to ask about it. If the requester declines to narrow the request, you still have to search. Ask early, ask once, and record when you asked and when they replied.

Section 78 of the Data (Use and Access) Act 2025 confirms that a requester is entitled to the information you can find through a reasonable and proportionate search. That is not a licence to search less. It means searching everywhere the data is likely to be, and being able to explain where you looked and why you stopped.

In a typical independent school that list includes the management information system (iSAMS, SchoolBase or similar), the safeguarding and pastoral record system (CPOMS, MyConcern or similar), Microsoft 365 or Google Workspace mailboxes and shared drives, Teams or chat messages, the bursary and fees system, admissions and bursary application files, medical and SEN records, boarding house notes, CCTV where relevant, and paper files. A data map that records where each type of data lives makes this step far quicker, and a written search log is your evidence if the requester later complains to the ICO.

This is where most of the time goes, and where the risk sits. School records are full of other people: classmates named in incident reports, the other parent in a separated family, staff giving candid views in emails. Where information about someone else cannot be separated from the requester's data, you need either that person's consent or a judgement, which you record, that disclosing it is reasonable in all the circumstances. Staff acting in their professional role will often be named, but a teacher's personal opinions or health are a different matter.

The Data Protection Act 2018 then sets out the exemptions that matter most to schools. Schedule 2 covers legal professional privilege, confidential references the school has given, examination scripts and the timing of examination marks, and information about ongoing negotiations with the requester (which can include a fee dispute). Schedule 3 covers education data, allowing you to withhold information that would be likely to cause serious harm to the physical or mental health of the pupil or another person, and information about child abuse where a parent is requesting on a child's behalf and disclosure would not be in the child's best interests. Exemptions apply to specific pieces of information, not to the whole request, and the decision for each should be recorded.

Redact digitally and check the output. A black marker pen on a printout can often be read through, and a redacted PDF that still holds the original text underneath is a data breach in its own right.

The response should include a copy of the personal data and the supporting information required by Article 15: why the school holds it, who it has been shared with, how long it will be kept, where it came from, and the requester's rights, including the right to complain to the ICO (and, now that schools must run their own data protection complaints process, how to complain to the school). If the request arrived electronically, reply in a commonly used electronic format, and send it securely (an encrypted file or a secure portal rather than an ordinary email attachment). There is no fee for a first copy.

You can refuse all or part of a request only if it is manifestly unfounded or excessive, and the bar is high. A request made in the middle of a dispute is not unfounded simply because the requester is angry with the school. If you refuse, explain why, and tell the requester that they can complain to the ICO or seek to enforce their rights through the courts.

Finally, keep the file: the request, the acknowledgement, any clarification or identity correspondence, the search log, the record of exemption and redaction decisions, and a copy of what was disclosed. Retain it in line with your retention schedule, as it is the school's evidence if the decision is ever challenged.

Most requests are routine. The ones that take real time tend to fall into a few patterns, and each has its own trap.

During a fee dispute or exclusion. Parents sometimes use a request to gather evidence before a claim, or to apply pressure over unpaid fees. The motive does not make the request invalid, so answer it on its merits, but take care with internal discussion of the dispute itself (the negotiations exemption may apply) and with any legal advice the school has received (which is privileged).

From one parent in a separation. The file will often hold the other parent's contact details, correspondence and circumstances, and sometimes information about the reasons for the separation. Review it as if the other parent were a stranger, and check for court orders before disclosing anything about the child.

From a member of staff in a grievance or after leaving. Staff requests usually mean searching mailboxes for every mention of the person, which is where volume and third-party data peak. A settlement agreement or non-disclosure agreement does not remove the right of access.

Where safeguarding records are involved. Information from the Designated Safeguarding Lead's records, or shared by children's social care or the police, needs individual review against the serious harm and child abuse exemptions. Where information came from another agency, consult them before disclosing it.

Parents at maintained schools in England have a separate right to see their child's educational record under the Education (Pupil Information) (England) Regulations 2005. That right does not apply to independent schools. Parents of pupils at an independent school receive an annual written report on their child's progress under the Independent School Standards, and anything beyond that is requested through subject access, with the child's own rights in mind. It is worth making this distinction clear in your privacy notice and your rights request procedure, because parents who have had children in the state sector often expect the educational record route.

Since 19 June 2026, every controller, including every independent school, has had to run a process for data protection complaints under section 164A of the Data Protection Act 2018. In practice, a parent unhappy with a response will now usually complain to the school first, and the ICO can decline to act on a complaint that has not been raised with the school. You must acknowledge a complaint within 30 days, look into it properly and keep the complainant informed, so build that step into your procedure alongside the request itself.

This guide reflects UK law as at 29 October 2026 and is general guidance, not legal advice about a particular request.

GDS Analytics Limited. Registered in England No. 12389759. Registered office: 32 Lon Gwynfryn, Swansea, SA2 0TR. VAT No. 361 2779 87. ICO registration ZA667093.

Website by Melton Web Design Experts, SBNR