What type of request have you received? SAR? Educational Record? Or FOI?

We know the jargon can be confusing. As can the timelines for responding to the various requests that you receive. Whether it’s an email from a disgruntled parent or a letter from a solicitor, the clock starts ticking the moment it hits your inbox. But before you start pulling files, you must answer one critical question: What exactly are you looking at?

Is it a Subject Access Request (SAR) under the UK GDPR? Is it a request for the Official Educational Record under the 2005 Regulations? Or is it a Freedom of Information (FOI) request?

The Importance of Clarifying a Request

• Missing statutory deadlines: 15 school days vs. one calendar month.

• Data Breaches: by releasing information you shouldn't.

• Wasted resources: performing broad searches when a simple file export would suffice.

• Complaints from parents for failing to respond within the correct timeline.

Tip: Ignore the labels. A parent might ask for an "FOI," but if they want their child’s data, it’s a SAR. You must respond according to the nature of the data requested, not the terminology used by the requester.

Identify the Request Type

When a parent asks for information, first clarify the scope. If they require a history of the child's progress, attendance and behaviour, follow the Educational Record protocol.  This is a streamlined process focusing on the 'formal file' has a 15-school-day deadline. 

If the request specifically demands 'all data held' or 'all internal correspondence', it must be treated as a Subject Access Request (SAR), which follows the UK GDPR timelines of one calendar month and requires a much broader search, including staff emails.

Use this breakdown to determine your workflow and your deadline.

Request Type	What is it?	Deadline
Educational Record (ER)	A request for the "formal file" (reports, attendance, progress).	15 School Days (Clock stops during holidays).
Subject Access Request (SAR)	A request for all personal data held (including internal emails/notes).	One Calendar Month (Clock does NOT stop for holidays).
Freedom of Information (FOI)	A request for non-personal, recorded school info (policies, budgets).	20 School Days (or 60 working days if sooner).

The Pupil Educational Record

Governed by the 2005 Regulations for Maintained Schools: Education Act 2005.

1. Scope Identification

The goal is to provide the "formal history" of the child.

• Include: Academic reports, assessment data, attendance registers, SEND/Welfare files, and CPOMS/MIS behaviour logs.

• Exclude: Routine correspondence with parents, internal administrative emails, and process-oriented emails with external agencies.

2. Data Extraction

• MIS Summary: Run the "Pupil Brief" or "Summary Report" from your Management Information System (Arbor, SIMS, Bromcom, etc.) as the foundation.

• Welfare/SEND: Collate final versions of IEPs/EHCPs and formal reports from external professionals (e.g., Educational Psychologists).

• Behaviour: Export the behaviour incident log (including CPOMS entries where there is no risk of harm).

3. The Redaction & Review

Before any document is released, it must be "scrubbed" for third-party data.

Category
The Subject Pupil	Keep all references.
School Staff	Keep names (Professional Capacity).
External Professionals	Keep names (e.g., Social Workers).
Other Pupils	Redact all names and identifying features.
Other Parents	Redact names and contact details.

4. The "Serious Harm" Check

The Headteacher or DSL must review the final pack. If any entry (particularly in CPOMS) could cause serious harm to the physical or mental health of the pupil or another person if disclosed, that specific entry must be withheld.

5. Final Assembly & Dispatch

• Ensure pages are numbered.

• Attach the Covering Letter (clarifying that correspondence is excluded).

• Provide the file via a secure method (Encrypted email or "Signed For" post).

The Subject Access Request

Governed by Article 15 of the UK General Protection Regulation (GDPR) and the Data Protection Act 2018.

1. Check the request

• Remember that requests do not have to use the words 'subject access request' nor do they have to tell you the time limit to respond.  The requestor may be a pupil, parent/guardian, employee or governor or anyone you hold data on.
• Validate the identity of the requestor. 
• The request could come in many different forms, including social media.
• Requests may come from local authorities or law enforcements.

2. Log with your DPO

• DPE Customer should log on the Knowledge Bank
• Acknowledge the request. DPE Customers can use our template letter.

3. Collect the data

• Plan the collection and redaction of the data requested - might take longer than you think.
• DPE Customers can review our Redaction Best Practice Area.

4.Respond and send the data

• Send a letter (DPE customers can use our template)
• Ensure you send by a secure method (DPE Customers can request a secure link from us).
• Ensure you keep a copy of the redacted and unredacted information that has been provided.

The Freedom of Information Request

Governed by the Freedom of Information Act 2000.

1. What is it? 

• A request for any recorded information held by a public authority in England, Wales and Northern Ireland.
• It must be in writing with details of the requestor and a description of the information requested

2. What should I send?

• It includes printed, documents, computer files, letters, emails etc. but does not include personal data, as that would be a Subject Access Request.

3. Responding

• The response should not include any personal data.
• You should already have the information in a recorded format.
• There are exemptions to responding; contact your DPO before making such a decision.
• You must always respond even if you do not have the data.
• Note - sometimes people mistakenly ask for an FOI when they mean a SAR.

Data Request Type Chart: 

 

Download

Note: Academies and Independent schools are technically governed by their Funding Agreements and the UK GDPR. While they must fulfill SARs, they may not be strictly bound by the 15-day ER rule—check your specific policy.

Still not sure?

Here are some simple questions to help you decide:

• Is it about a person? If yes, it is not an FOI
• Is the request from a parent? If yes, check if they are asking for the 'Official Record' (reports/attendance) or 'Personal data (emails/notes).
• Calculate the deadline
• Check for third party data

Who has Access to the Education Record?

Definition of Parent Under Education Law 

Parental Responsibility as defined in s 3(1) if the Children Act 1989 is not the determinative factor in relation to accessing the educational record of the child.  This is because the definition of “parent” in education law is much wider.

---

Under section 576 Education Act 1976 (which applies to maintained schools) a “parent” includes a child’s natural parents; anyone with Parental Responsibility for the child; or anyone who is caring for a child. 

The Position for Maintained Schools - The Education (Pupil Information) (England) Regulations 2005.

If the child concerned attends a maintained school, the parent or carer will have a right to access the child’s educational records and information about the child under The Education (Pupil Information) (England) Regulations 2005. The educational records defined in the regulations, can include information about the pupil’s academic achievements, correspondence from teachers and major disciplinary incidents such as exclusions. It will cover information that comes from a teacher or other employee of a local authority or school, the pupil or you as a parent. However,  It does not include any information about the pupil that a teacher keeps solely for their own use.

The request must be made in writing and the school will have 15 school days to respond. Governing bodies of schools cannot charge parents for viewing the educational record. However, it can  charge a fee for providing a copy, the fee must be no more than the cost of making the copies  The application of a fee for the cost of supply may be a reason why parents with parental responsibility seek to use the DPA 2018 to make a request for educational data, exercising the data rights of the child by making a subject access request.  

The regulations provide exemptions to the disclosure of information within the educational record of the child if for example;

• the information may cause serious harm to the physical or mental health or condition of the pupil or someone else
• disclosure would reveal examination marks before they are officially announced

The Position for Academy, Independent and Free Schools.

The Education (Pupil Information) (England) Regulations 2005 does not apply to academy, independent or free schools and there is no equivalent legal right of access to information. Consequently a parent or carer will need to check the school’s policies to find out what information they are entitled to and bear in mind that what they are entitled to may be set out in the contractual relationship between the school and the parent. 

However, academies do have to provide certain information to parents in accordance with Part 6 of the Independent School Standards.  This includes an annual written report of each registered pupil’s progress and attainment in the main subject areas taught.

The lack of an equivalent legal right for academy, independent and free schools may be likely to account for the reason why parents with parental responsibility use the DPA 2018 to make a request for educational data, seeking to exercise the data rights of the child by making a subject access request.

Glossary of Terms:

• Parental Responsibility (PR): A legal status under the Children Act 1989. Only individuals with PR (or those acting in loco parentis) have the automatic right to request an Educational Record.

• Maintained School: A school funded by the local authority. These schools must comply with the 15-day Educational Record rule.

• Academy / Independent School: These schools are governed by their funding agreements and the UK GDPR. While they must fulfil a SAR, they are not technically bound by the Education (Pupil Information) Regulations.

• Redaction: The process of masking or removing sensitive information (like the names of other children or staff members) from a document before it is released to the requester.

• Manifestly Unfounded or Excessive: A legal threshold under GDPR where a school can refuse a SAR or charge a fee if a request is clearly intended to cause harassment or is repetitive.