20 December 2023

How to respond to a data dilemma in school

Emma Hastings-Bray Senior Associate
Woman pulling file out of drawer

The scenario

Mr Cross, a parent of a child attending the school:

  • Is unhappy with the service which he has received from the school’s receptionist

  • Has decided to submit a subject access request (SAR) - asking for all of the information which the school holds on him

  • Submits the request verbally over the phone to the office manager as part of his complaint

How do you deal with Mr Cross's SAR quickly and efficiently?

  • Request ID from Mr Cross without delay so that you can confirm his identity
  • Consider whether you can ask Mr Cross to clarify his request
  • Confirm how Mr Cross would like to receive his personal data
  • Follow the school's rights of access policy which should cover SARs
  • Notify and seek advice from the school's Data Protection Officer
  • Make a note of response deadlines
  • Undertake a search for the information quickly
  • Consider the exemptions in the Data Protection Act 2018 so you're clear what information should NOT be provided
  • Seek advice on how to handle any third party data
  • Use professional redaction software

What to watch

  • SARs can be made verbally so ensure staff are trained to recognise these

  • Seek advice on exemptions and redactions to avoid disclosing data Mr Cross is not entitled to

  • Act promptly don’t leave responding to the last minute

  • Follow policies and procedures

  • Avoid undertaking black pen redactions - these can often be seen through

Emma Hastings-Bray, Wilkin Chapman LLP
Need help?

Contact Emma to discuss this further.

Back to top