Subject access requests: guidance and template forms

Individuals have the right to request access to the information your school holds about them, under the UK GDPR. Use this guidance and our template forms to help you comply with subject access requests and know when you can refuse them.

Last reviewed on 20 February 2023
School types: All · School phases: All
Ref: 34360
Contents
  1. What are subject access requests?
  2. Use our template forms to help DPOs handle requests
  3. How to respond to a request
  4. Requests from parents about their children's data
  5. When you can refuse a request, and how you must do it  
  6. Brief your team on data protection 

This article is based on:

What are subject access requests?

Individuals have a right to access (or request someone access on their behalf) the personal data you hold about them. This is set out under article 15 of the UK GDPR and is explained further in guidance from the Information Commissioner's Office (ICO).

This allows them to be aware of, and verify the lawfulness of, you processing this data. 

How soon must we comply with a request? You must comply as soon as you can, at the latest within 1 month of receiving:  The request, or   Any information you request to confirm the identity of the person making the request  A

Read next

Also in "Data protection and sharing information"