SEND subject access requests: a guide for schools
Parents preparing for an EHCP dispute or a SEND Tribunal appeal may ask the school for everything it holds about their child. Here is what is in scope, how the deadline works, and how to handle other people’s information.
- UK GDPR and DPA 2018
- GOV.UK and ICO guidance
- Schools and MATs
Why SEND requests are different
A SEND-related request usually asks for everything: years of emails between staff, notes from meetings, assessments and correspondence with the local authority. The parent may be gathering evidence, so the response may be read closely, possibly by a solicitor or at a tribunal.
That raises the stakes on both sides. Missing records undermines trust, and a missed redaction discloses another child’s information. The legal rules are the same as for any SAR; the volume and the scrutiny are what make these harder.
What is in scope
The parent is entitled to the child’s personal data, wherever the school holds it. GOV.UK guidance says schools must make reasonable efforts to search all records. For a SEND request that can include:
- Emails, including those in deleted or trash folders, across every staff mailbox likely to hold them: the SENCo, class teachers, teaching assistants, the head and the office.
- Notes, reports and documents about the child’s needs, support and progress, including SEN support plans and records of meetings.
- EHCP-related records the school holds: annual review paperwork, contributions to an EHC needs assessment, and correspondence with the local authority.
- Information in record systems, databases and spreadsheets, instant messages, CCTV, and paper records held in filing systems.
The right is to the child’s personal data, not to whole documents. For something like governors’ minutes, you can extract the parts about the child rather than release the whole document.
The deadline
One calendar month, from the day it arrives
A request received on 10 March is due by 10 April. If there is no matching date (31 January), use the last day of the month. If the deadline falls on a weekend or bank holiday, it moves to the next working day.
No pause for school holidays
A request that arrives on the last day of the summer term is still due a month later. Make sure someone can pick requests up during the holidays.
Up to two more months, for complex requests only
Tell the parent in writing within the first month why it is complex and when they will get a response. Retrieving or redacting a lot of information does not, in most cases, make a request complex.
The clock pauses for ID and clarification
While you wait for ID, evidence of authority, or reasonable clarification of what they want. Record when you asked and when you heard back.
Check your dates with the SAR deadline calculator.
A workflow that holds up
1
Log it and diary the deadline
Record the date it arrived. It counts as a SAR even if the parent does not call it one, and even if it came in a conversation at the gate or an email to the class teacher. Work out the deadline with the SAR deadline calculator.
2
Check who is asking, and for whom
A SAR is the child’s right. A parent or carer can make one on the child’s behalf. If the child is 13 or over, check whether they are happy for their data to be shared with their parent. If you do not already know the requester, ask for ID, and evidence of authority if someone such as a solicitor is acting for the family. The clock is paused while you wait.
3
Collect everything in scope
Export the relevant mailboxes (from Microsoft 365 with Microsoft Purview, or from Google Workspace with Google Vault) and gather the SEND file, notes and records. You can ask the parent to clarify what they are looking for, but you cannot ask them to narrow the request.
4
Redact other people, and record why
SEND emails are full of other people: other pupils in the same class or incident, their parents, staff, and professionals from outside the school. Redact information that identifies anyone other than the child, unless there is a reason to release it. Make that decision case by case and record it.
Consider whether an exemption applies, for example where releasing information would cause serious harm to the child, or would prejudice an investigation, or where it is legal advice the school has received.
5
Send the response, and keep both versions
Make sure redactions cannot be undone, send the response securely, and include your DPO’s contact details, how to complain to the ICO and the right to seek a judicial remedy. Keep a record of the process, and copies of the redacted and unredacted versions in case the response is reviewed.
Where RedactBox helps
RedactBox handles the email part of the request. Upload the mailbox exports (PST, MBOX, EML or MSG) and any PDFs, remove duplicate copies of the same email, and search for another pupil’s name to redact it across every item at once rather than email by email.
Exported PDFs have the redacted text removed, not covered, and each project gives you a Schedule of Redactions and a CSV audit log to evidence your decisions. Attachments are flagged so none are missed, but they are not redacted inside the email: save the ones in scope as PDFs and upload them. There is no OCR, so scanned documents are redacted by drawing over them.
Free to try on one document. Professional is £25 a month. SAR redaction for schools.
SEND SAR questions
Do school holidays pause the deadline for a SAR?
Can we extend the deadline for a large SEND request?
Can a parent make a SAR for their child’s SEND records?
Do we have to disclose the EHCP?
Should we redact teachers’ and the SENCo’s names?
Is a SAR the same as a request for the educational record?
Can we charge a fee?
Based on the GOV.UK guidance Data protection in schools: dealing with subject access requests, the ICO’s right of access guidance and regulation 5 of the Education (Pupil Information) (England) Regulations 2005. This is general guidance to help you plan, not legal advice. For a contentious request, take advice from your DPO service or legal adviser.
Free: the SAR redaction checklist
The step-by-step checklist for redacting a Subject Access Request correctly: third-party data, audit trail and all. Straight to your inbox.
Get through the email part faster
Upload the mailbox exports, redact other pupils and parents across every item in one pass, and export with a Schedule of Redactions.