Subject Access Requests

The school’s Data Protection Officer will deal with all subject access requests received. This is based on advice from the Information Commissioner’s Office’s guidance.

How we will respond to subject access requests

On receiving a request, our Data Protection Officer will contact the individual via phone to confirm the request was made. We will then verify the identity of the person making a request using ‘reasonable means’. Generally, this means we will ask for two forms of identification.

In most cases, we will provide the information within one month and free of charge. If the request is complex or numerous, we can comply within three months, but we will inform the individual of this within one month and explain why the extension is necessary.

We will provide the information in a commonly used electronic format if the request is made electronically.

We recognise that school holidays are counted in the response time, and if we receive a request in the school holidays, we will still respond within the same time frame.

Unfounded or excessive requests

If the request is unfounded or excessive, we will either:

• charge a reasonable fee for you to comply, based on the administrative cost of providing the information
• refuse to respond
• comply within three months, rather than the usual deadline of one month; however, we will always inform the individual of this and will explain why

Usually, ‘unfounded’ or ‘excessive’ means that the request is repetitive, or asks for further copies of the same information.

Refusing a request

When we refuse a request, we will:

• respond to them within one month
• explain why we are refusing the request
• inform the individual that they have the right to complain to the Information Commissioner’s Office