Subject Access Request Support for Schools

Data Access Office offers subject access request support to schools all-year round. When a subject access request (SAR) is received,you are legally required to respond within “one calendar month” from the date it is received. During term time, this can stretch resources when staffing levels are already constrained by limited budgets. During holidays, this can seem like an impossibly tight deadline. We can help.

We Act as an Additional Data Protection Officer

Data Access Office provides end-to-end support for handling subject access requests. Every request is led by a fully-qualified data protection officer (DPO) who can either handle the request on your behalf or guide you and your team through the process.

From receipt of the request, we take control. We carry out an initial review to assess the scope, complexity and proportionality of the request. We’ll draft and manage all correspondence, creating a robust audit trail for your protection. We carry out athe secure collation and upload of documents into our online case management system, carry out any lawful redcation that is required, before delivering the completed request to your school.

Where requests are broad or unclear, we will advise you on lawful refinements and exemptions, including:

  • pausing the statutory response clock where appropriate
  • assessing whether an extension is justified
  • applying “manifestly excessive or unfounded” provisions when time and resource thresholds are met.

The result is a compliant, defensible outcome with minimal disruption to your day-to-day operations. Even when you are operating on a skeleton staff such as during holidays.

The process of what happens when a Subject Access Request is received

Step 1: a subject access request is made to your school
  1. Request receivedWe draft and manage the initial response, acknowledging receipt and setting the process in motion.
Step 2: we search school records and collate data related to the request
  1. Secure document collation
    Relevant data is identified, collated, and securely uploaded into our online case management system.
A qualified data protection officer scopes the claim
  1. Expert review & scope assessment
    A qualified Data Protection Officer (DPO) reviews the materials and advises on scope, exemptions, or refinement.
We ensure compliance within statutory timescales even during school holidays
  1. Lawful extenstion of the deadline
    We will extend the one month deadline in cases that are complex or when multiple requests from the same person have been received.
We carry out any redaction required
  1. Redaction & response preparation
    Documents are reviewed, lawfully redacted, and prepared into a compliant response pack.
Subject access requests are delivered with a full audit trail
  1. Final delivery
    The SAR is issued on your behalf with full audit trails.
    ✔ Deadline met
    ✔ Risk reduced
    ✔ Client reassured 😊

Get in touch

iapp logo