Subject Access Requests in Schools: An Overview

Over a pupil’s time at school, a detailed picture builds up. Attendance and reports. Behaviour notes and special educational needs plans. Emails between staff, parents and outside agencies. All of it is personal information, and all of it can fall within a subject access request. 

This Industry Pulse gives an overview of how subject access works across the education sector this term: who makes requests, what they cover, how the school year affects them, and what changed in 2026. It draws on the Department for Education’s guidance on SARs and the ICO’s guidance on education information. 

Who makes subject access requests in education 

Schools hear from a wider range of people than most organisations. The DfE lists pupils, parents and carers, teachers and support staff, volunteers, governors, and third parties such as solicitors acting for someone else. 

The reasons vary just as much. A former pupil might ask for attendance records to prove they attended the school. A parent might want their child’s records for a particular term. A solicitor might request special educational needs records on a family’s behalf. 

Requests don’t follow a set format. People can ask any member of staff, in person, by phone, in writing or on social media, and they don’t need to use the words “subject access”. That’s why most schools route every request to one named person, with a single log across all their sites. 

What a DSAR covers 

A data subject access request (DSAR) gives a person the right to their personal information. It doesn’t give them a right to whole documents. A pupil’s details in a set of governors’ minutes, for example, can be extracted and shared with a note on where they came from. 

The search itself is broad. The DfE expects schools to look across emails, documents, spreadsheets, record systems, instant messages, CCTV and paper files. Much of this now sits with suppliers, from management information systems to cloud storage, so supplier contracts usually set out how they help. 

Records about one pupil often mention others. Information about other children is usually removed, while staff acting in their professional role are normally disclosed. Each decision is recorded, so the school can explain it later if asked. 

Pupils, parents and educational records 

The right of access belongs to the pupil, and there’s no minimum age. Parents can make requests on behalf of children who aren’t yet able to act for themselves, and schools weigh the child’s maturity and wishes as they get older. 

Alongside subject access, parents at maintained schools in England have a separate right to see their child’s educational record, with a 15 school day response time. Academies and free schools aren’t covered by that right, so in a trust, parent requests are handled as subject access requests. 

Subject access across the school year 

The legal time limit is one calendar month, and it runs the same way in term time and in the holidays. Schools plan for this by keeping the data protection inbox covered through every break. 

The month can pause while a school waits for ID or a genuine clarification, and complex requests can be extended by up to two further months. In most cases, there’s no fee. 

What changed in 2026 

The Data (Use and Access) Act 2025 brought the most notable change for schools this year. Since 19 June 2026, people can make data protection complaints directly to a school or trust. Under the ICO’s complaints guidance, each complaint must be acknowledged within 30 days, looked into without undue delay, and answered with an outcome. 

The Act also put two long-standing principles into law: searches must be reasonable and proportionate, and the clock can pause while a school waits for information it genuinely needs. For most schools, these confirm existing good practice rather than change it. 

New to the process?  

Start with our step-by-step guide to handling a subject access request. For short, insightful updates each week, follow DSAR.ai on LinkedIn. And if there’s a tricky request on your desk, talk to our team. 

 

This article is general information for UK schools, not legal advice.