This guidance explains how pupils and parents may make a Subject Access Request (SAR) to the Academy and how such requests will be handled.

What is a Subject Access Request?

A Subject Access Request (SAR) is a request made by an individual to access personal data that an organisation holds about them, and which is processed in an automated or manual filing system.

Personal data is:

• information that identifies an individual, and
• relates to them in a meaningful way.

Examples of data which may identify an individual include:

• Basic identifiers such as name, DoB, home address
• Special categories of data such as ethnicity, religious beliefs, health data

Your information access rights

Under data protection legislation, individuals have the right to:

• request access to their personal data
• receive a copy of their personal data (subject to lawful exemptions)
• understand how their personal data is used

There are two distinct rights relating to information we hold:

1. A pupil’s or parent’s right of access to their own personal data under article 15 of the UK GDPR.  Individuals are only entitled to receive information that relates to or is about them, however they may ask someone else to exercise their right and act on their behalf.  Where a legitimate request is made, we will provide a response without undue delay and no later than within one calendar month, although this can be extended by a further two months in certain circumstances.
2. A parent’s right to access their child’s education record (e.g. attendance records, behaviour records, termly/ annual school reports, letters to parents from school about their child etc) under the Education (Pupil Information) Regulations 2005.  In England, this right only applies to maintained schools, therefore Academies/ Trusts are under no obligation to provide this information.  Should we agree to provide this, we will do so within 15 working school days.

The rights children have to make a request

Children can make their own Subject Access Request, regardless of age.

Parents/carers may submit a SAR on behalf of their child only where the child is not able to exercise their own rights, or where they ask them to act on their behalf.

Where this is the case we:

• may ask for written confirmation (consent) from the child. We will first assess whether requesting consent is in the best interests of the child and whether they are able to understand the request.
• will always consider whether responding to the parent’s request is in the best interests of the child.

Each request will be considered on a case by case basis.

Where we need consent to proceed, the time period to respond is paused until we receive the outstanding information.

How you can make a request?

Requests can be made in writing or verbally. To help ensure we have all necessary information to respond efficiently, you may complete your request via the following form [to be provided shortly].

All requests should be sent to: headteacher@hartonacademy.co.uk

Please be as clear as possible and include:

• The full name of the person whose data is being requested
• The full name of the person requesting the information, if this is different to the person whose data it relates to. Where this is the case please specify your relationship to the individual.
• The specific information you require along with any names of individuals who may be the author or recipient of the information in question and any relevant time periods e.g. SEND Support Plans between year 7 to 9: or Attendance Records for the last 2 years; or annual school reports for the last 3 years etc.

The clearer and more specific you can make your request will enable us to efficiently locate the information to meet your requirements.

If your request is very broad or unclear or we need to process a large volume of information, we may contact you to:

• ask for clarification about the specific information you require, or
• request additional information to help us locate the specific information you require

The time period to respond to your request is paused until we receive your clarification.

Whilst the use of Artificial Intelligence (AI) tools are becoming common place to help draft such requests, please use with caution as they often mean the request is not relevant to your requirements, they can overly complicate requests or cite incorrect laws making the request more complex than necessary.

Requesting proof of your identity

Before responding to a SAR, we must be satisfied of the identity of the requester.

We may need to ask you for:

• proof of your identity, and/or
• proof of authority to act on behalf of another person.

This is to ensure personal data is disclosed securely and lawfully. The time period to respond to your request is paused until we receive appropriate evidence of your identity.

Time periods to respond to your request

We will provide a response to your information request without undue delay and no later than within one calendar month, although this can be extended by a further two months where the request is complex or where it concerns a large amount of data. Where this is the case we will notify you of the need to extend the time period.

We will also pause your request whilst we await either clarification from you, where we require consent to proceed, or where we await evidence of your identification.

Reasonable and proportionate searches

We will carry out reasonable and proportionate searches of our records to locate the specific information you require.

We will make all reasonable efforts to find and retrieve the information however this will not extend to searches that are unreasonable or disproportionate to the importance of providing access to the information. In doing so we will consider:

• The circumstances of your request
• The volume of information we may need to search
• Any difficulties involved in finding the information
• The fundamental nature of your right to access.

In the Academy we hold personal data in our various filing systems (electronic and in some cases, manual) and in the form of many different records, these may include:

• Termly or annual school reports
• Pupil behaviour or attendance records
• Pupil safeguarding or pastoral records
• SEND support plans
• Accident logs
• Emails or other correspondence

There are many factors we must consider to determine whether the information we hold is in fact your personal data. This includes considering the content, context, purpose and the effect the processing has on you. There will be circumstances such as in emails or other correspondence where data we hold may reference you or be linked to you (i.e. your name may be detailed) but does not ‘relate’ to you as the content is about something else. We review each record on a case by case basis and disclose only information that we are required to under data protection legislation.

Emails, general correspondence or other records which are not classified as official records are not routinely retained.

Refusing or partially fulfilling your request and charging a fee

 There are some circumstances where we may refuse or only partially fulfil your request. This may be the case where we deem your request to be:

• Manifestly Unfounded – where it is clear your request is intended for purposes other than to genuinely exercise your legal right of access. We may also consider charging a fee.

• Manifestly excessive – where your request is repetitive, excessive in scope, or places a disproportionate burden on the Academy/Trust. We may also consider charging a fee.

• Include information about other individuals – we will consider whether it is reasonable to redact their information, seek their consent to disclosure or otherwise, withhold the information. Examples include emails or correspondence where you are referenced but also contain other people’s information; CCTV footage where we are unable to protect the identity of others.

• Not deemed to be in the best interests of a child – where disclosing information may be detrimental to the child.

• Concerning confidential information – where there is a reasonable expectation that the information is not shared, such as witness statements, or sensitive health or family matters or where they have been provided to us by another professional body/agency.

• Information provided to or from our legal team

We may also hold information that has been provided to us by another party, for example, other parents, professionals or members of the public. Where this is the case we may need to check first whether we can release the information or alternatively we may be required to withhold the information.

There are other reasons why we may not be able to fulfil your request, including where it may cause serious harm to the physical or mental health of any person. Where such exemptions apply, we will only withhold information or refuse your request where the law allows us to.

Providing the information to you

To ensure we comply fully with all our obligations, we may not provide you with copies or original documents and instead provide excerpts or a summary of your personal data. Furthermore, where you can access the information yourself such as through the Parent App, we will advise you how you can find the specific information you require.

We will always aim to provide the information to you in electronic format unless you specifically request otherwise. We will always ensure the information is provided in a readable, accessible and secure manner. Usually, we will provide access by means of a link to a secure server, from where you can access or download the information.  Please be aware that if you download the information, the Academy cannot be held responsible for its security.

Should you request repeat copies of information you already hold or have access to, we may decline your request or charge a fee for this.

How to raise a concern or complaint about how we’ve handled your information access request

 If you are concerned or unhappy with how we have handled your SAR, you may:

• Raise the matter with us, for further information please review our Data Protection Complaints Procedure [to be provided]
• Alternatively you may email us at headteacher@hartonacademy.co.uk
• We will provide an initial acknowledgement to you within 30 days of receipt and then provide a full response without undue delay.
• Should you remain dissatisfied, you also have the right complain to the Information Commissioner’s Office (ICO) at Information Commissioner’s Office.