Subject Access Request Redaction for Schools 

A subject access request (SAR) allows an individual to ask a school or trust for access to their personal data and information about how it is being processed. Schools must identify relevant information, consider exemptions and protect other people's personal data before responding.

Schools generally have one month to respond to a subject access request. The timeframe can be extended by up to two further months where a request is complex or multiple requests are received, but the school must explain why an extension is necessary.

A school cannot normally refuse a valid subject access request simply because it is inconvenient or time-consuming.

However, UK GDPR provides limited circumstances where information can be withheld or a request may be considered manifestly unfounded or excessive. Schools should seek appropriate data protection advice before refusing a request.

Schools generally cannot charge a fee for responding to a SAR. A reasonable fee may be permitted where a request is manifestly unfounded or excessive, or where an individual requests additional copies of information already provided. Schools should assess each situation carefully before charging.

Judicium provides secure SAR redaction services for schools and MATs, helping identify and remove third-party or exempt information before disclosure.

Automated redaction provides fast, scalable processing, while our comprehensive service adds expert review for complex or higher-risk requests.

Our Automated Redaction Service is designed for straightforward, high-volume or time-sensitive SARs.

For complex disclosures, our Comprehensive Redaction Review combines automated processing with specialist review, exemption application, quality assurance and final certification.