Subject Access Request to a School

Parents routinely assume the records are theirs because the child is theirs. Under data protection law they are not. The ICO’s current children’s guidance is unambiguous: “Even if a child is too young to understand what their data protection rights mean, they are still that child’s rights rather than anyone else’s”. A person may exercise them on the child’s behalf only where the child authorises it, the child does not have sufficient understanding to do it themselves, or it is clearly in the child’s best interests.

The test is capacity, not birthdays. The ICO says a child can exercise their rights themselves at any time where they have the capacity to do so, and that what matters is whether they can “understand and deal with the potential consequences” — for example, whether they understand what it means to ask for a copy of their information and how to read what comes back. The one place a number appears is Scotland, where a person aged 12 or over is usually taken to be mature enough unless there is evidence otherwise. The ICO says that presumption does not apply in England, Wales or Northern Ireland.

Two official sources give two different ages, and neither is the law. The DfE’s guidance for schools says that if a young person is over 13 you should treat the request as you would an adult’s, and that where a child is 13 or over you should check whether they are happy for their data to go to a parent. The DfE’s own page about requests to the department uses 12 instead. Both are working practices for the people applying them, not thresholds you can hold a school to. If a school refuses you on the basis of an age, the question to ask is what assessment of your child’s understanding it actually made.

In practice this means an older child can ask for their own file and get it; a school can ask a teenager whether they consent to their parent seeing it, and can decline if they say no; and a request by a child is itself some evidence of the understanding needed to make it. Where you and your child both want the records, the cleanest route is usually the child making the request with your help.

The definition is in regulation 3 of the 2005 Regulations, and two things in it are worth knowing before you ask for anything.

It expressly includes the plans. Regulation 3(4) says an educational record includes any EHC plan and any personal education plan relating to the pupil. So a parent at a maintained or special school can get the EHC plan and the PEP on the 15-school-day route, without a subject access request at all. A personal education plan is the plan a local authority must ensure is provided for every child in its care, which makes this route directly relevant to foster carers and to anyone supporting a looked after child — see social services records for the care file itself, which is a separate request to the council.

Two things are carved out, and one surprises people. Information processed by a teacher solely for the teacher’s own use is not part of the educational record, and neither is information given about your child by another child’s parent. The ICO lists both. Note the limit of the first one carefully: it takes a teacher’s genuinely private notes out of the education record route. It is not a general licence to keep notes about a pupil away from a subject access request, which reaches personal data wherever it is held.

What to name when you ask. The DfE’s guidance tells schools to make reasonable efforts to search “emails (including those in deleted or trash folders), documents, spreadsheets, databases, record systems, CCTV, USB sticks or CDs, paper records in filing systems, instant messages”. Its own worked example has a pupil’s personal data extracted from the minutes of a governors’ meeting, so governor and panel papers are in scope where your child appears in them. Naming the systems, the staff and a date range is the single most useful thing you can do. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

Health records held by the school are on a different regime. The Data Protection Act 2018 defines education data as information forming part of an educational record that is not information concerning health, so a school nurse’s or therapist’s clinical records follow the health rules instead — see medical records.

The school is usually the right first request, but it is not the only holder, and two of the three are routinely missed.

1. The school. The governing body of a maintained school, or the academy trust, is the controller for what the school holds — the file, the emails, the behaviour and attendance logs, the safeguarding record, staff notes. The ICO confirms that where a school is in England, Wales or Northern Ireland, “the school is responsible for dealing with the SAR”. Scotland is the exception and is dealt with by the education authority or, for an independent school, its proprietor.

2. The local authority. A council is a separate controller with its own file, and it is the one that holds the EHC needs assessment paperwork: the advice it gathered, the panel’s reasoning, the decision correspondence. The school will hold its copy of the plan and its own SEN records; it will not hold the council’s casework. If you are appealing a council’s decision, the council’s file is the one you want, and it is a second request to a second organisation.

3. The Department for Education. This is the one almost nobody knows about, and it is the answer when the school no longer exists or was decades ago. The DfE publishes that you can request pupil attainment and pupil characteristics data held in the National Pupil Database, where the majority of the data relates to children who attended school in England from the 2001 to 2002 academic year onwards, and separately a personal learning record documenting GCSEs, A levels, BTECs, diplomas and functional skills. The DfE says it does not cover all educational establishments and does not cover Welsh schools, and that for a learning record it is usually quickest to ask the learning provider first.

An exclusion is the commonest reason people arrive on this subject, and the request is worth aiming rather than sending blank. The decision you are challenging rests on records the school already holds: the behaviour log and its history, the incident reports and witness accounts, the correspondence between staff about your child, what was recorded about earlier sanctions, and — where SEND is in play — what the school knew about your child’s needs and when.

Two practical points. Expect other pupils’ names to be redacted: the DfE’s own worked example turns “excluded due to a fight she had with Sajid Khan” into “a fight she had with (REDACTED)”, and says the parent is entitled to their child’s personal data, not the other child’s. Staff are different: the ICO says it is “normally reasonable to disclose information that identifies a teacher”, so a member of staff’s name blacked out of a decision about your child is worth querying.

And a subject access request gets you personal data rather than documents. The DfE is explicit that a request “does not entitle them to access full documents” and that a school may extract the relevant passages and give context for where they sit. A four-page set of governors’ minutes can lawfully come back as two sentences. That is not obstruction, and knowing it in advance is the difference between a useful complaint and a wasted month. If you want the whole document rather than the parts about your child, the exclusion procedure itself — the papers put before the governing board — is the route, not a records request.

Some things genuinely can be withheld. Knowing which is the difference between a productive complaint and a wasted month, and the two education-specific ones sit in Schedule 3 of the Data Protection Act 2018.

Serious harm (Part 4, paragraph 19). The right of access does not apply to education data to the extent that disclosure would be likely to cause serious harm to the physical or mental health of the pupil or of another person. It bites only to the extent it applies, so it is a redaction power rather than a refusal power. The ICO notes it does not apply to independent schools in Scotland.

Child abuse data, where a parent is asking (Part 5, paragraph 21). Where a person with parental responsibility requests data about a child under 18, the right of access does not apply to child abuse data to the extent that disclosure would not be in the best interests of the child. Two limits matter and both cut in the requester’s favour. It is drafted around a request made by someone else about the child, so it is not aimed at a young person asking for their own file. And paragraph 21(5) says it does not apply in Scotland.

Other people in the records. Other pupils, other parents and third parties have rights too, so expect redactions — but a school must still disclose what it can, and the decision is case by case rather than a blanket rule.

Records held by a court. Where education data was supplied in a report or as evidence in family or children’s proceedings and the court’s own rules allow it to be withheld, it is exempt. The ICO adds the qualification that matters: this “does not mean that you can withhold all information just because there are ongoing legal proceedings”.

Exam marks not yet announced. The ICO lists a request that would mean releasing examination marks before they are officially announced as a ground for refusing an education record request. For the marks and scripts themselves, see the awarding body rather than the school. More on when a request can be refused or limited.

What it costs. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies. That is the subject access route. The education record route is different and this is the one place where paying is normal: regulation 5 makes inspection free but allows the governing body to charge for a copy, at a fee “not exceeding the cost of supply”. The regulations set no scale; the ICO publishes an indicative one running from £1.20 for 1 to 19 pages up to £50 for 500 or more, so treat a quote in that range as ordinary and anything above it as worth questioning.

How long they have. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why. For an education record request it is 15 school days instead, which excludes school holidays. A long file with a lot of correspondence is the kind of thing that attracts an extension on the subject access route, so assume three months rather than one if you are asking about several years.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it. The DfE tells schools that pupils and their parents are generally well known to staff, and that if they know you and are sure of your identity they do not have to ask for ID at all. Where you are asking about your child rather than yourself, expect to be asked to evidence parental responsibility, and expect any court order about contact or responsibility to be taken into account.

If the answer is late or incomplete — and which door. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office. That is the subject access route. The education record route does not end at the ICO: the ICO states that education regulations “are not regulated by the Information Commissioner’s Office” and directs complaints about an education record request to the organisation’s own complaints procedure. So the same delay can have two different remedies depending on which request you made, which is one more reason to know which one you sent. Our free subject access request response checker walks through what a complete answer should contain.

If you have not made a request before, what a subject access request is covers what counts as personal data, and our free letter template is wording you can send yourself at no cost.