Exam Scripts, Exam Marks and Subject Access

Students can’t use a subject access request to get copies of the answers they wrote in an exam. They can ask for their marks and other information about how their results were decided, but if they ask before results are announced, the school has longer to reply. 

Exam season brings its own kind of subject access request. A student wants to see their mock paper. A parent asks for the teacher assessments behind a predicted grade. A candidate emails the week before results day asking for their marks. 

 The Data Protection Act 2018 has two specific rules for these requests, both in Schedule 2, paragraph 25. One covers exam scripts. The other covers exam marks. Here’s how each works, in plain terms, for exams officers and data protection leads. 

Exam scripts: what students write is exempt 

The first rule is simple. Information a candidate records during an exam is exempt from the right of access. In practice, that means a student can’t make a subject access request for a copy of their answers. 

The ICO’s guidance for teachers and schools confirms this includes answers written in mock and preliminary exams, not just final papers. The law defines an exam broadly too. It covers any academic, professional or other exam used to test a candidate’s knowledge, skill or ability, and can include an assessment of their performance while doing work or another activity. 

The exemption only covers what the candidate wrote. It isn’t a blanket exemption for everything connected with an exam. 

Exam marks: the information is released, just later 

Marks are treated differently. A student is entitled to their marks and to other personal information used to decide their results. The ICO gives examples: 

• teacher assessments 
• how teachers reached their decisions 
• performance records 
• emails about a student’s provisional grade 
• What changes is the timing. If a request for this information arrives before results are announced, the usual one-month time limit doesn’t apply. Instead, the school must respond by whichever comes first: 
• five months from when the request is received, or 
• 40 days from when the results are announced. 

Results count as announced when they’re first published or, if they aren’t published, when they’re first given to the candidate. 

Once results are out, the special rule falls away. A request made after results day is a normal subject access request, with the usual one-month time limit. 

What this means for exams officers 

Most of the work is in recognising which rule applies, and recording why. 

Check what’s being asked for. A request for “my exam paper” is usually a request for the student’s own answers, which are exempt. A request for “everything you hold about my grade” is likely to include marks, assessments and emails, which aren’t. 

Check the date against results day. Note whether the request arrived before or after results were announced. That decides which time limit applies. 

Explain it to the requester. Tell the student what you’re providing, what’s exempt and when they can expect a reply. A short, clear explanation avoids confusion and makes a complaint less likely. 

Remember other people. Assessment records and emails can mention other students or staff. The usual rules on other people’s information still apply. 

Sharing isn’t banned. The rules limit what a student can demand, not what a school can choose to share. The ICO notes that schools can still discuss a student’s performance with them. 

The ICO says its exam guidance is under review following the Data (Use and Access) Act 2025. The exam provisions in the Data Protection Act 2018 themselves haven’t changed. 

 

New to the process?  

Start with our step-by-step guide to handling a subject access request. For short, insightful updates each week, follow DSAR.ai on LinkedIn. And if there’s a tricky request on your desk, talk to our team.