Under the GDPR, everyone has specific rights over their own data which apply in certain circumstances. One of the most common rights to be exercised is the right to request personal data – this request is referred to as a ‘Data Subject Access Request’ – this is usually shortened to ‘Subject Access Request’.  

A Subject Access Request (SAR) allows an individual (the ‘data subject’) to ask an organisation what personal data it holds about them. In the context of a pupil, this could include information such as reports, emails, behaviour records, or SEN records, or for employees, this can include HR files, training records etc. 

Through a SAR, you can request any personal data held about you—this includes names, contact details, behaviour records, SEN information, or health-related data. The key factor is that the data must be “personal data”—information that identifies a specific individual. 

Although you can request any personal data, it is helpful to consider what you actually need, as a very broad request may take longer and produce a large amount of irrelevant information. It’s often more helpful to specify what type of data you’re interested in, such as emails from specific staff or records about particular incidents.   

General school documents, policies, or other information that is not directly about you can’t be requested through a SAR. For more general information, you would need to make a Freedom of Information (FOI) request instead. Policies can also be found on the USP or school’s policies pages.  

It’s important to note that unlike Local Authority maintained schools, Academies are not subject to the Pupil Information Regulations – this means that parents do not have an automatic right to access their child’s records.  

Some data, such as annual reports and attendance data, is shared with parents in line with Independent School Standards,  

Parents can support their child to access their own personal data. Usually where a child is aged 12 or older, we will require proof that the child has given permission to do so. We may also require proof of parental responsibility if the request comes from a contact we don’t recognise.   

In our special schools, parents do have a right to access education data under the Pupil Information Regulations, but any non-education data will be subject to the UK GDPR.  

Some personal data may be accessible to ‘self-serve’ by the data subject or a guardian via systems like Class Dojo, the Arbor Parent App* or Go4Schools*. For staff, some personal data may be accessible via Every HR. *Please note, systems may not be used by all USP schools. 

Most personal data is shared as part of existing processes we carry out. Some data may be shared during ‘regular’ occurrences which apply to the majority such as, sharing school reports with legal guardians, calling a parent/guardian about their child being unwell or discussing behaviour concerns. Various data may also be shared at specific points in relation to processes such as Permanent Exclusions (PEX) panels, EHCP applications and reviews and complaints or grievance investigations.  

It may be that you should already expect the information you’re requesting a different way which may be quicker and easier, for example, behaviour information is usually shared within the PEX panel paperwork. 

If you just want to be re-sent a copy of something the school has shared with you previously, such as an attendance report, it may be worth discussing with the school informally first as this may resolve the matter without needing to make a formal request.  

If your request comes from an unknown contact, we may require you to provide ID before we are able to respond, or proof of parental responsibility.  

In some cases, we are allowed to refuse a request where it is deemed Manifestly Unfounded or Manifestly Excessive. If we believe this is the case, we will advise you in writing as soon as we are able to. More information about refusal of requests can be found here: Manifestly unfounded and excessive requests 

Once a Subject Access Request (SAR) is received and we have all the necessary information to process it, we will respond within one month. This means you’ll usually receive the data within 1 calendar month from the date the request is verified—not necessarily the date you first contacted us.  

In some cases—such as when the request is complex or involves a large volume of data—we are allowed to extend this timescale up to three months to respond. If we need this extra time, we will inform you within the first month and explain why the extension is needed.  

This deadline will be the corresponding day of the month, and if this falls on a non-working day such as a weekend or public holiday, it will be rolled to the next working day.  For example, if a request is made on the 18th,  January, the one-month deadline will be the 18th February, or in a complex case, the 18th April.  

However, this timescale doesn’t start until we have all the information we need. If we need to verify your identity, confirm your authority to act on your child’s behalf (if applicable), or ask for clarification around what information you are asking for, we will be unable to start the process until we have received this.  

More information about timescales, and where a case may be extended can be found here.  

Not necessarily. We are only able to provide data that already exists within a searchable system – organisations are not required to create additional data sets to respond to SARs.  

While you are entitled to receive data about yourself, some information may be withheld or redacted if it includes data about other people or is subject to a legal exemption. Exemptions are considered on a case-by-case basis.  

Legal exemptions may include but are not limited to:  

• Safeguarding records, referrals or investigations. (Schedule 3, part 5) 

• Health, education or social work data. (Schedule 2, part 2; Schedule 3, part 2-5) 

• Data relating to legal services including legal advice.  (Schedule 2, part 4 (19))  

• Data relating to police investigations or reports. (Schedule 2, part 1) 

• Business & management information. (Schedule 2, part 4 (21-23) 

• Confidential references.  (Schedule 2, part 4 (24)) 

• Exam scripts & marks. (Schedule 2, part 4 (25))  

For more information about exemptions, please see here.  

While we may be unable to provide exempt data, you may be able to obtain data via another source. For example, the Local Authority may be able to provide safeguarding or social work data, or the police may be able to provide information relating to their investigations.   

You can make a SAR verbally or in writing, but the best way to make a SAR is to fill in our SAR form linked here as this will allow us to make sure we have all the information we need to fulfil the request as soon as we can.  If you make your request verbally or in writing but it is not clear enough, we may ask you to complete the form to assist us in processing your request.  

Where possible, be as specific as possible about what data you need. It is also helpful for us to understand the reason you are asking for the information, although this is not required it can help us to identify data or to advise you where data may be accessible via a different route.  

Once your request is received, and (where applicable) we have received of ID, proof of parental responsibility or consent to act on another person’s behalf, we will acknowledge your request.  

Where possible, your request will be handled by our central information governance team, but it may be necessary for us to involve the school or other central team members in the gathering of data to fulfil your request.  

We will always do our best to provide the data you have requested as soon as possible and will advise you if we are unable to meet the 1-month deadline.  

When  the requested data has been gathered, any exempt data has been removed or redacted, and the data is ready to be shared. Typically, we will do so by sharing a secure link for you to access the data, unless you have specified that you are unable to receive digital copies.  

Getting copies of your information (SAR) | ICO 

What to expect after making a subject access request | ICO 

Getting a response to your subject access request | ICO 

Why organisations might partially or fully refuse a subject access request | ICO 

What to do if you don’t get a response or you’re unhappy with it | ICO