Subject Access Request to Ofsted

Ofsted holds personal data about several quite different people, and which one you are decides whether a subject access request is the right tool at all. If you complained to Ofsted about a school, Ofsted holds its own file on that complaint. It says it holds personal data given to it by people making complaints about schools, usually including the complainant's details and their children's, and that it can share complaints information with schools to help it investigate them. The school's or academy trust's own file about your child is a different controller and a separate request - see school records. Complaints about independent schools are always passed to the Department for Education, because Ofsted says it has no powers to act on them, so the DfE will hold that correspondence as well. A complaint is not a records request and does not become one. Ofsted's complaints policy says its process sits outside the public's right under the Freedom of Information Act 2000 or the Data Protection Act 2018 to access information Ofsted holds, and outside appeals against Ofsted's regulatory decisions to the First-tier Tribunal (Care Standards). If you want something investigated rather than disclosed, Ofsted's complaints procedure is free, and Ofsted asks you to complete the school's or provider's own procedure first. For a state school it publishes a 30 working day response time and says the complaint must be about things affecting the whole school rather than individuals. For childcare it says it will not reply to you directly and cannot resolve an individual disagreement with your provider, and that a childminder registered with a childminding agency must be complained about to the agency. Complaints about a council's children's services go to the council and then the Local Government Ombudsman; complaints about children and family court services go to Cafcass. An inspection report is not personal data and needs no request. Ofsted publishes reports for schools, colleges, childminders, nurseries, children's homes and more in England, and anyone can search its inspection reports. Information Ofsted holds that is not about you personally is a Freedom of Information request instead. Registered providers have the largest Ofsted file of anyone. Ofsted says it keeps information about a registered person's suitability for at least as long as they are registered, and possibly longer where compliance issues or concerns were raised during the registration, and that what it holds can include details of criminal convictions and alleged offences, health information, and relevant information received about personal life and relationships. Anyone aged 16 or over living in a childminder's home is in the same position, because Ofsted checks them too. Ofsted's inspection evidence about a children's home or a fostering or adoption agency can also contain information about the children who used it - but the care file itself belongs to the council or the provider, not to Ofsted; see social services records. Ofsted runs two information mailboxes and only one of them is a route for getting your own data. informationrequest@ofsted.gov.uk is published for Freedom of Information requests and as the Data Protection Officer's address for concerns about how Ofsted handles personal information. The address Ofsted names for getting a copy of the personal information it holds about you is enquiries@ofsted.gov.uk, listed with the helpline and Ofsted's contact form under the heading Contact Ofsted. That contact form is a general service for finding the right way to contact Ofsted, not a subject access form. The postal address above is Ofsted's Information Rights and Access team. Ofsted publishes it on its publication scheme page as the address to write to with a Freedom of Information request, and separately registers it with the Information Commissioner's Office as its Data Protection Officer's address. Ofsted publishes no postal address specifically for subject access. 0300 123 1231 is Ofsted's general enquiries helpline, given in the same block as the email and the contact form. Ofsted's personal information charter says it is open 8am until 6pm Monday to Friday; Ofsted's own GOV.UK homepage says 9am to 5pm Monday to Friday, and adds that you can use the Next Generation Text Service if you have difficulty hearing or speaking on the phone. The charter also prints that same number a second time inside its block of contact details for the Information Commissioner's Office - the ICO's own helpline is 0303 123 1113, which the charter gives correctly higher up the same page. The right of access applies to living people, so records about someone who has died are not a subject access request, and Ofsted publishes no alternative process for one.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.