07 July, 2022
Individuals have a right to access and receive a copy of their personal data under the UK general Data Protection Regulation (GDPR) and this is known as a subject access request (SAR).
A SAR can be made verbally or in writing and this includes via social media and the request does not need to state that it is a SAR.
Individuals can make SARs as well as third parties on behalf of another person. If a child is mature enough to understand their rights, even they can make a SAR and you can respond directly to them.
In relation to schools, parents or guardians may make a SAR for information you hold about a child or children. If the request is from a parent or guardian exercising the child or children's rights, you can respond if the child or children authorise it or if it is in the best interests of the child or children.
You must respond to a SAR within 1 month of a request although this can be extended by a further two months if the request is complex or you have received a number of requests from an individual.
At Forbes we have a data protection and GDPR specialist team who offer a wide range of advisory services, DPO support packages and regularly advise schools on SARs. Should you have any further enquires, require more information or support please do not hesitate to contact either Daniel Milnes or Gemma Duxbury.
Learn more about our Education department here