School Data Request Compliance: UK Legal Guide

Why education paperwork affects funding, housing, and rights

Every term, thousands of parents, guardians, and pupils in England and Wales submit data protection requests to schools. These requests—often called subject access requests (SARs)—ask for copies of personal data held by the school. While most schools aim to comply, many responses fall short of legal requirements under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA2018). When responses are incomplete, delayed, or lack a clear lawful basis, families may face unnecessary stress, lost time, and even formal complaints to the Information Commissioner’s Office (ICO).

The stakes are real. A poorly handled SAR can lead to reputational harm for the school, wasted staff hours, and potential regulatory scrutiny. For families, it can mean missing out on critical information—such as records of behaviour incidents, special educational needs (SEN) assessments, or safeguarding notes—that could affect a child’s education or well-being. With the ICO increasingly focused on education-sector compliance, schools must ensure their responses are not only prompt but also legally sound.

This guide helps you review your school’s data request response for compliance. It’s not about blame—it’s about clarity. By checking key areas like lawful basis, retention periods, and subject access rights, you can spot gaps before they become problems.

Is your document complete and internally consistent?

A well-prepared school data request response should feel complete, transparent, and easy to understand. It should clearly state:

• What personal data the school holds about the pupil
• Why the school is processing that data (the lawful basis)
• How long the data will be kept
• The pupil’s rights, such as correcting inaccurate information

If your response lacks these details—or if it’s late, vague, or missing key documents—it may not meet legal standards. This guide walks you through the checks that matter most.

Education rules in plain English

Three UK laws shape how schools handle personal data: the Equality Act 2010 (EqA2010), the Education Act 1996 (EA1996), and the Data Protection Act 2018 (DPA2018). Here’s what they mean in practice:

Data Protection Act 2018 (DPA2018) This is the UK’s main data protection law, alongside the UK GDPR. It sets out rules for how organisations—including schools—must handle personal data. Key points:

• Schools must have a lawful basis for processing personal data (e.g., consent, legal obligation, or public task).
• Pupils and parents have the right to access their personal data through a subject access request (SAR).
• Schools must respond to SARs within one month (with limited exceptions for complex requests).
• Data must be kept securely and deleted when no longer needed.

Education Act 1996 (EA1996) This law covers the duties of schools, local authorities, and parents. While it doesn’t focus on data protection, it includes provisions that affect how schools handle records. For example:

• Schools must keep registers of pupils and maintain records of their progress.
• Local authorities must provide information to parents about their child’s education.
• Schools must comply with requests for information from parents, unless there’s a legal reason not to.

Equality Act 2010 (EqA2010) This law protects people from discrimination, including in education. It’s relevant to data protection because:

• Schools must ensure their data practices don’t discriminate against pupils with protected characteristics (e.g., disability, race, or gender).
• For example, if a school holds sensitive data about a pupil’s SEN status, it must handle that data carefully to avoid breaching equality laws.

Together, these laws create a framework for how schools collect, use, and share personal data. If a school fails to comply, it could face complaints, ICO investigations, or even enforcement action.

Five education-document checks students often miss

1. Subject access: Is the response complete and on time?

What to check A subject access request (SAR) under the DPA2018 gives pupils and parents the right to see the personal data a school holds about them. The school must:

• Respond within one month (unless the request is complex, in which case it can extend the deadline by two months).
• Provide all the personal data it holds, unless an exemption applies (e.g., data that identifies another person).
• Explain why the data is being processed and how long it will be kept.

Practical tip Compare the response date to the date you submitted the request. If it’s late, check whether the school explained the delay in writing. Also, review the documents provided—are they complete? For example, if you requested behaviour records, are all incidents included, or are some missing?

How VetroCheck helps VetroCheck’s School data request: compliance review flags missing data, late responses, and unclear exemptions. Upload your response, and we’ll highlight gaps in seconds.

---

2. Lawful basis: Does the school explain why it holds your data?

What to check Schools must have a lawful basis for processing personal data under the DPA2018. Common bases in education include:

• Public task: The school needs the data to perform its official duties (e.g., keeping attendance records).
• Legal obligation: The school is required by law to hold the data (e.g., safeguarding records under the EA1996).
• Consent: The pupil or parent has agreed to the processing (e.g., for school trips or photos).

The school’s response should clearly state which lawful basis applies to each type of data. If it doesn’t, the processing may not be legal.

Practical tip Look for phrases like “public task” or “legal obligation” in the response. If the school relies on consent, check whether it’s specific and freely given. For example, a school can’t make consent a condition of admission.

How VetroCheck helps VetroCheck checks whether the school’s response includes a lawful basis for each category of data. If it’s missing or unclear, we’ll flag it.

---

3. Retention: Does the school say how long it will keep your data?

What to check Schools must not keep personal data longer than necessary. The DPA2018 requires them to have a retention policy that explains:

• How long different types of data will be kept (e.g., attendance records, SEN assessments).
• When and how data will be securely deleted.

The ICO provides guidance on retention periods for schools, but these can vary. For example:

• Pupil records: Typically kept until the pupil turns 25 (for safeguarding reasons).
• Behaviour logs: Often kept for 6–12 months after the incident.
• Exam results: Usually kept indefinitely for reference.

Practical tip Does the response include a retention schedule? If not, ask the school for its data retention policy. If the school says it keeps data “indefinitely,” that may not comply with the DPA2018.

How VetroCheck helps VetroCheck compares the school’s retention periods to ICO guidance and flags any inconsistencies or missing details.

---

4. Exemptions: Did the school withhold data fairly?

What to check Schools can withhold data in certain circumstances, but they must explain why. Common exemptions under the DPA2018 include:

• Third-party data: If the data identifies another person (e.g., a teacher or another pupil), the school may redact it unless the other person consents.
• Legal professional privilege: If the data is subject to legal advice (e.g., in a dispute), the school may not have to disclose it.
• Safeguarding: In rare cases, disclosing data could harm a child’s well-being.

The school must justify any exemptions in writing. If it withholds data without explanation, it may be in breach of the DPA2018.

Practical tip Check whether the school redacted or withheld any data. If so, does it explain why? For example, if behaviour records mention another pupil, the school should say it redacted the name to protect that pupil’s privacy.

How VetroCheck helps VetroCheck reviews exemptions and flags any that are unclear or unjustified. We’ll tell you whether the school’s reasoning holds up.

---

5. ICO complaint: Could this response trigger a complaint?

What to check If a school’s response is incomplete, late, or unfair, you can complain to the ICO. The ICO can investigate and, if it finds a breach, order the school to improve its practices. Common triggers for complaints include:

• Late responses (beyond the one-month deadline).
• Missing or incomplete data.
• Unclear or missing lawful basis.
• Unjustified exemptions.

Practical tip If you’re considering a complaint, gather evidence:

• The date you submitted the SAR.
• The school’s response (or lack of response).
• Any correspondence about delays or exemptions.

How VetroCheck helps VetroCheck’s review includes a risk assessment for ICO complaints. If your response has red flags, we’ll highlight them and suggest next steps.

Education paperwork mistakes with lasting cost

1. Assuming “no response” means “no data”

Some schools fail to respond to SARs at all, leaving parents in the dark. Under the DPA2018, silence isn’t compliance—it’s a breach. If a school ignores your request, you can escalate to the ICO. Many parents waste months waiting for a response that never comes, only to realise they should have acted sooner.

2. Accepting vague lawful bases

A common mistake is accepting a generic statement like “we process data for educational purposes.” The DPA2018 requires schools to specify the exact lawful basis (e.g., “public task under the EA1996”). Without this, the processing may not be legal, and the data could be at risk of misuse.

3. Overlooking retention periods

Some schools keep data indefinitely “just in case,” but this violates the DPA2018’s principle of storage limitation. If a school can’t explain how long it will keep your data—or why—it may be holding it unlawfully. This can create risks, such as data breaches or unauthorised access.

FAQ

What does the School data request: compliance review review?

The School data request: compliance review is an information-only audit of education documents. It focuses on four key areas:

• Subject access: Is the response complete, on time, and compliant with the DPA2018?
• Lawful basis: Does the school explain why it holds your data?
• Retention: Does the school say how long it will keep your data?
• ICO complaint: Could the response trigger a complaint to the Information Commissioner’s Office?

Each finding is backed by a citation from your document, so you can see exactly where the gaps are.

Which legal sources are used in the review?

The review is based on three key UK laws:

• Data Protection Act 2018 (DPA2018): The main data protection law in the UK.
• Education Act 1996 (EA1996): Covers the duties of schools and local authorities.
• Equality Act 2010 (EqA2010): Protects against discrimination in education.

Which specific points are checked?

The agent checks:

• Whether the school’s response to a subject access request is complete and on time.
• Whether the school provides a clear lawful basis for processing your data.
• Whether the school explains how long it will keep your data.
• Whether any exemptions (e.g., third-party data) are justified.
• Whether the response could trigger an ICO complaint.

Each finding includes a citation from your document, so you can verify the results.

Which documents can I upload?

The School data request: compliance review accepts PDF files up to 20 MB. It’s designed for:

• School data request responses (e.g., SAR responses from primary or secondary schools).
• Correspondence about data protection (e.g., emails or letters from the school).

How much does the review cost and how long does it take?

The full analysis costs £12.99. Results are usually ready within a few minutes as a PDF download. You’ll receive a clear, actionable report highlighting any compliance gaps.

Upload your education document — £12.99

If you’ve received a response to a school data request, here’s how to check it for compliance:

1. Gather your documents: Collect the school’s response and any related correspondence.
2. Check the basics: Is the response on time? Is it complete? Does it explain the lawful basis?
3. Review retention periods: Does the school say how long it will keep your data?
4. Assess exemptions: If data was withheld, does the school justify it?
5. Consider next steps: If the response is incomplete or unfair, you may need to follow up with the school or escalate to the ICO.

VetroCheck’s School data request: compliance review automates these checks for you. Upload your documents, and we’ll analyse them against the DPA2018, EA1996, and EqA2010. Our report highlights gaps, explains the risks, and suggests next steps—all in plain English.

Important note: VetroCheck is not a law firm and is not regulated by the Solicitors Regulation Authority (SRA). Our reviews are information-only and do not constitute legal advice. For legal advice, consult a qualified solicitor.

Ready to check? Upload your document for a structured PDF review — £12.99.

Check your document now — £12.99

Also see the agent topic page for statute themes and related checks.