Subject Access Request Policy

Subject Access Request (SAR) Policy & Procedure 

What is personal data?

For information to be personal data, it must relate to a living individual and allow that individual to be identified from that information (either on its own or in conjunction with other information held alongside it). The individual to whom the personal data relates to is the ‘Data Subject’.

A Subject Access request (SAR) can be made by

• any parent/carer acting on behalf of their child(ren) as the Data Subject or
• any parent/carer acting in their own individual right as the Data Subject or
• any member of staff as the Data Subject

to find out what personal information is held about them.

How to make a Subject Access Request (SAR)

A request can be submitted to the school via the Subject Access Request (SAR) Form which can be found at the back of this document or can be downloaded as an electronic copy from the school’s website at https://www.willownursery.co.uk/policies/

The SAR Form must be submitted directly to the School Manager – Trina Evans to avoid delay in dealing with the request. Our School Manager is specifically responsible for responding to a SAR.

If our school receives a request for information in writing by letter or email, we will ask the requester to complete our SAR Form so that our School Secretary can process your request quickly and easily.

We aim to deal with SARs efficiently and transparently and our School Secretary will consult with the requester about how best we can provide the information requested. We will ask the requester about their preferred method of receiving the information. However, in cases where supplying a copy of the requested information in a hard copy would result in disproportionate effort, we would evaluate the particular circumstances of each request and reach agreement with the requester as to an alternative way of satisfying the request.

We will ascertain the most appropriate and secure way to provide you with the information.

Charges for SARs

A Subject Access Request is free of charge. However the school has the right to charge a reasonable administrative-cost fee should the request be excessive (i.e. involves complex data retrieval) or repetitive (i.e. involves additional copies of information already provided) which imposes a disproportionate administration burden on the school. We will provide evidence of how we make this decision about a request being excessive where appropriate.

Confirming the requester’s identity

We will ask the requester for some form of ID to ensure that the person making the request is the individual to whom the personal data relates (or a person authorised to make a SAR on their behalf). We will also check that we have the requester’s correct postal address.

When dealing with SARs for personal data relating to a pupil at our school, we will clarify whether the requester has parental responsibility for the child or has the authorization to act on their behalf.

Making a SAR on behalf of someone else

If the requester is making a SAR on behalf of someone else (the ‘Data Subject’), we need to be satisfied that the ‘third party’ requester making the request is entitled to act on behalf of the Data Subject. It is the responsibility of the third party requester to provide evidence of this entitlement to the school.

The school has discretion in deciding whether information in response to a SAR is disclosed to a third party who has made the SAR on behalf of the Data Subject or disclosed directly to the Data Subject. If disclosed directly to the Data Subject, then the Data Subject can choose to share the information with the third party if they wish.

Clarifying a SAR

Before we respond to a SAR, we may ask for additional information from the requester to enable us to find the personal data covered by the request.

Each SAR received will be acknowledged and once the necessary ID checks have been satisfied and clarification sought regarding the context of the personal data being requested, we will inform the requester of the date by which the response must be provided (within one month).

How long will information resulting from a SAR be available?

In accordance with the GDPR regulations, the school will provide the required information within one month from the date the school is satisfied with the confirmation of the identity of the requester and agreed the nature and requirements of the information being requested. The school has the right to extend this period for particularly complex requests which may require more time to process.

Whilst we aim to respond to requests within the required time period of one month, we may not be able to honour this time period if we receive requests just before or during school holidays. If the nature of the request is complex and/or the request falls within a holiday period, we will aim to reach a mutually agreed alternative time period.

If there is a delay in dealing with the request for any reason, we will contact the requester to explain the reason and the expected date for the response.

Information that is exempt from SARs

Certain types of personal data are exempt from SARs because of its nature or effect its disclosure may have (e.g. safeguarding or legal issues) or where disclosure would involve information about another individual. In these cases, we will explain to the requester the reasons why information requested cannot be disclosed.

How information is provided

Our responses to a SAR will include an explanation of the searches that have been made to deal with the request and the information revealed by those searches so that the requester is able to understand whether they have received all the information they are entitled to.

Monitoring our compliance with responding to SARs

We retain a log of SARs received which includes the details of requests received which we update to monitor progress as the SAR is processed. The log contains copies of the information supplied in response to the SAR together with copies of any material withheld and an explanation why.

We also monitor the time period for responding to SARs as well as deal with requests that have not been dealt with within the one month timeframe.

Compliance with dealing and responding to SARs is monitored and discussed at senior leadership level and with our Trust Board/Board of Governors.

Complaints about our Subject Access request procedure

If the requester believes that a request for information has not been dealt with properly, the requester should make a complaint to the school through our normal complaints procedure. If following the conclusion of the complaints procedure within the school, the requester is still dissatisfied or the original decision is not reviewed, the requester can complain directly to the Information Commissioner’s Office (ICO) at https://ico.org.uk/concerns .

Please follow the link to access the Subject Access Request Form