Subject Access Request to Qualifications Scotland (SQA)

SQA is now Qualifications Scotland. Its own site says "Qualifications Scotland is the new qualifications body created by the Education (Scotland) Act 2025", that it will award all qualifications previously awarded by SQA, and that you will see both names while it moves its website across. So a request about SQA exams goes to Qualifications Scotland, and the form is titled the Qualifications Scotland Subject Access Request Form. The ICO register carries the new name as well, at ZC088977, and that registration lapses on 2 October 2026. Check the free route before you make a request. A My Qualifications Scotland account costs nothing and, in the organisation's own words, "will let you see all the qualifications you completed since 1995". A replacement certificate is a separate, chargeable service at £40. A subject access request is free and does tell you what Qualifications Scotland holds about you — but it will not produce a certificate, and the certificate is the document an employer or a university will accept. Your exam script is not part of what comes back. Qualifications Scotland is explicit: "No. You will not receive a copy of your exam script, or any other non-examination material submitted to us, such as coursework, in response to a subject access request (SAR)." What you do get is "a copy of other personal information that we hold about you, including marks or grade bands, where this information is available" — so the marks and grade bands are in scope even though your own answers are not. Coursework goes back through a separate, chargeable Return of External Assessment Materials service, which for the 2026 exam diet closes to requests on 27 September 2026. Component marks are a different ask again. Qualifications Scotland says information about them "can also be requested from your school, college, or training provider", which is a request to a separate organisation holding its own records about you. Qualifications Scotland acknowledges a request within five working days and answers within a calendar month. Someone else can only ask for your information with your written authorisation, and there is a separate Candidate Representative Data Access Request Form for a request made for a person who cannot give that authorisation because of a disability. The form itself warns that you "may be committing a criminal offence if you make false or misleading statements to obtain or attempt to obtain someone else's personal information". The privacy statement publishes a data protection telephone number, 0345 213 5229, for questions about the information Qualifications Scotland holds and how it is used. It is not offered as a way of making a request, which is why it is not listed above. If your exams were sat in England, Wales or Northern Ireland, a different awarding organisation holds them and has its own route — AQA, OCR and Pearson Edexcel are three of them. If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing.

Made under UK GDPR Article 15, subject to the examination exemptions in Schedule 2, Part 4 of the Data Protection Act 2018

An exam board holds your entries, candidate number, marks, moderation and appeal records, and its correspondence with your school or college about you. A university or college holds all of that plus your student record, admissions file, misconduct and fitness-to-practise files. Requests usually arise from a disputed grade, an appeal, a misconduct allegation, or simply needing a record of results from years ago.

Your exam answers are treated differently in law. Under paragraph 25 of Schedule 2, Part 4 of the Data Protection Act 2018, the right of access does not apply to information recorded by candidates during an exam — so, as the ICO puts it, candidates do not have the right to copies of their answers to the exam questions. What the marker recorded is a different matter: the ICO's guide to the exemptions states that information recorded by the person marking the exam is not exempt, so marks and examiners' comments are within scope even though the script itself is not.

There is a timing rule for marks, and it is narrower than it is often described. It applies only where you ask before the results are announced. In that case the organisation must answer within five months of the request, or within 40 days of the results being announced if that comes sooner. Ask after results day and the ordinary deadline applies in full, as set out below.

• Marks, moderation records and examiners' comments
• Entry records, candidate numbers and the results held against your name
• Appeal, review-of-marking and malpractice records
• The full student record and admissions file, at a university or college
• Emails about you between staff, or between the organisation and your school

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.