Subject Access Request to the Department for Education

Most people searching for a subject access request to the Department for Education want a different organisation. A school's own file about a pupil belongs to the school or the academy trust, which is its own controller — start with what a school holds and how to ask for it. Exam scripts and marks belong to the awarding organisation: AQA, OCR, Pearson Edexcel or SQA. A student loan or student finance record belongs to the Student Loans Company, and an inspection or childcare complaint file belongs to Ofsted. DfE's own charter lists both of those among the arm's length bodies that "are data controllers in their own right". What DfE itself holds about an individual is mostly what schools, colleges, local authorities and exam boards sent it. DfE says you can ask for pupil attainment and pupil characteristics data in the National Pupil Database, where "the majority of data available in the NPD relates to children who attended school in England from the 2001 to 2002 academic year onwards"; your personal learning record; further education and work-based learning data from the individualised learner record; your case file if you complained about a school or college, or about the department itself; and, as a teacher, your qualified teacher status, teacher misconduct outcomes and teacher pensions data. DfE also collects children in need, children looked after and alternative provision data from local authorities. It says it does "not cover all educational establishments" and does "not cover Welsh schools", and that it "cannot provide information that other departments hold". DfE is the controller for its two executive agencies, so a teacher misconduct file is requested from DfE and not separately from the Teaching Regulation Agency. The TRA's own charter says only that "as an executive agency of the Department for Education (DfE), the DfE privacy notices provide information about the data we hold and your rights". The Standards and Testing Agency is the same. The Education and Skills Funding Agency became part of DfE in April 2025 and has no separate route. Teachers' Pensions is administered by Capita, and DfE is the controller: "For the purposes of data protection legislation, the DfE is the data controller for the data processed for the administration of the Scheme." So a request for pension scheme records is a request to DfE. DfE names two ways to make the request: its online contact form, whose first screen offers "subject access request" as one of five contact types, and post to the Data Protection Office at the address above. Its published mailbox, dataprotection.office@education.gov.uk, is offered for questions about how DfE uses your information and for complaints to the Data Protection Officer, rather than as a way of making the request — which is why it is not shown under where to send your request. DfE says a request can be made "verbally or in writing", so a letter that does not use the form is still a valid request; it publishes no telephone number for the verbal route. DfE says it will "try to respond to your request within 1 calendar month", and that "if your request is complex, this could take a further 2 months, but we'll tell you if this is the case". The personal learning record has its own separate route. DfE asks you to approach your learning provider first, because it "can take up to 1 month" for DfE to send a copy; if the provider cannot help, you download DfE's PLR request form and email it with two identity documents to lrs.support@education.gov.uk. That form says: "We cannot accept forms sent by post." The record only covers qualifications gained in England from 2012, Wales from 2014 and Northern Ireland from 2015, and only those regulated by Ofqual. Do not confuse the GOV.UK page called "Apply for Department for Education (DfE) personal data" with your own request. That page is for researchers applying for access to DfE data through the Office for National Statistics Secure Research Service and the UK Data Service, and it is not the route for asking what DfE holds about you. A child can make their own request. DfE says children "have the same data rights as adults", that it may assess a child's competency to act independently if they are under 12, and that a parent can request on a child's behalf where the child is under 12 or is not competent, on confirming parental responsibility. Its separate guidance to schools uses a different age: it tells schools that "a child does not have to be a certain age to make a SAR" and that a request from a young person over 13 should be treated as an adult's. So the number depends on who is being asked, and in both documents the real test is whether the child understands the request. If you have been referred to the Teaching Regulation Agency, DfE publishes what a request will and will not produce: "If the teacher makes a subject access request, we give details of the allegation but not the name of the referrer, unless the referral came from an organisation, when we give the name of the referring organisation." DfE publishes a second postal address at Piccadilly Gate, Store Street, Manchester M1 2WD for general correspondence and freedom of information requests. That is not the data protection route, and a subject access request should not be sent there.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.