When I first started auditing schools, I’d suggest they practise handling a subject access request (SAR) \u201cjust in case\u201d. That suggestion would be laughable today. <\/p>\n\n\n\n
Despite new legislation providing a clearer framework for managing this burden, schools are struggling to keep pace with the changing landscape.<\/p>\n\n\n\n
A SAR<\/a> is triggered when an individual requests a copy of their own personal data under the UK General Data Protection Regulation (GDPR)<\/a>, exercising their right to access their personal data being processed by an organisation.\u00a0<\/p>\n\n\n\n Experience shows that SARs typically arise from unhappy employees during grievance or disciplinary procedures, as well as from parents concerned about their child’s special educational needs, behavioural incidents or a school\u2019s handling of issues.<\/p>\n\n\n\n Increasingly, any complaint, disciplinary action, exclusion or accident on school premises is followed by a SAR. <\/p>\n\n\n\n Requests are handled by staff with additional responsibilities within schools or trusts \u2013 school business managers, office teams, special educational needs co-ordinators, headteachers, CEOs and COOs.<\/p>\n\n\n\n There have been several attempts to change the law to make SARs less burdensome, including one abandoned proposal that would allow organisations to refuse \u201cvexatious\u201d requests.<\/p>\n\n\n\n However, the Data (Use and Access) Act 2025, passed in June and being rolled out gradually over the coming months, provides schools with a clearer framework by requiring only “reasonable and proportionate” searches when responding to requests. <\/p>\n\n\n\n But a key issue is that requesters increasingly use AI tools like ChatGPT to generate requests. <\/p>\n\n\n\n While this democratises access by giving people confidence to submit requests, it can overcomplicate the process. <\/p>\n\n\n\n AI-generated SARs and follow-up correspondence are often threatening in tone and request irrelevant information, going beyond what an SAR should be \u2013 a simple request for personal information held.<\/p>\n\n\n\n Common sense about what’s reasonable and proportionate is essential. <\/p>\n\n\n\n One SAR we handled included a request for every staff meeting minute mentioning the requester’s daughter. When we asked whether they’d ever discussed this pupil in staff meetings, the answer was no \u2013 so no search was needed. <\/p>\n\n\n\n Sounds obvious, but the request (and its tone) had put the organisation into a spin about what they needed to search through. <\/p>\n\n\n\n 1. Prioritise human conversation<\/p>\n\n\n\n The Information Commissioner\u2019s Office, during a session on SARs at its annual Data Protection Practitioners\u2019 Conference in October, recommended acknowledging the use of AI in correspondence when handling a request. Rather than responding to every aspect of a long AI-generated request, instead asking for a human-led discussion on what specifically the requester really wants can often resolve a deadlock.<\/p>\n\n\n\n 2. Clarify, clarify, clarify<\/p>\n\n\n\n Don’t rush into searching. Spend time analysing the request carefully, determining exactly what’s wanted and the best data collection strategy.<\/p>\n\n\n\n 3. Don’t treat the request as a search map<\/p>\n\n\n\n The requester states what they want; the organisation determines what to search for using a reasonable and proportionate strategy.<\/p>\n\n\n\n 4. Do intentional searches, not just e-searches<\/p>\n\n\n\n While e-searches can be useful, restrict them to particular mailboxes, drives or timeframes. Consider manual searching \u2013 asking a teacher or line manager which emails and records they may have about the requester \u2013 with e-searches supporting rather than leading.<\/p>\n\n\n\n 5. Know when to stop<\/p>\n\n\n\n The ICO doesn\u2019t expect organisations to have ongoing, never-ending correspondence with an unhappy requester. Review decision-making processes to ensure communication beyond an initial SAR response is indeed reasonable and proportionate.<\/p>\n\n\n\n The Data (Use and Access) Act 2025 provides schools with the legal backing to take a more reasonable and proportionate approach to SARs.<\/p>\n\n\n\n Having a complementary strategy for responding to SARs and searching for information will ensure schools don\u2019t fall victim to the volume of requests.<\/p>\n","protected":false},"excerpt":{"rendered":" Subject access requests have become common but new legislation provides guidance on how to react sensibly, says Claire Archibald<\/p>\n","protected":false},"author":70,"featured_media":237485,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"footnotes":""},"categories":[6],"tags":[],"post-theme":[3726],"class_list":["post-237613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-opinion","post-theme-the-legal-leader"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tThe AI-generated requests problem<\/h3>\n\n\n\n
So how can schools better handle SARs?<\/h3>\n\n\n\n
Taking back control<\/h3>\n\n\n\n