Subject Access Requests
DATA PROTECTION ACT 1998
Guide to making a Subject Access Request
These notes are intended only as a guide to completing the Subject Access Request form, not as a guide to the Data Protection Act. The Data Protection law is set out in the Data Protection Act 1998 obtainable from The Stationery Office. Further information and advice is also available from the website of the Data Protection Regulator – the Information Commissioner – see www.ico.uk
1. Your Rights
Under the Act you have (subject to certain exemptions) the right to be told whether Hornbeam Academy Trust, as a Data Controller, is holding or processing any information about you; and if so, to be provided with a copy of that information upon specific request. The records covered by the Act include all computer records and limited categories of manual records. Under the Act a pupil, or someone acting on their behalf, has the right to access their personal information held by Hornbeam Academy Trust and its’ schools. The Act does not specify an age at which a child can make their own request. The information from the Information Commissioner’s website will give you further advice.
2. The Trust’s Rights
Where an exemption is available under the Act, the Trust / School may not provide you with the information covered by the exemption.
The main exemptions that may be applied are where the information held relates to:
- the prevention or detection of crime; or
- the apprehension or prosecution of offenders
Where the disclosure of the information would be likely to prejudice any of these purposes the School is not required to tell you whether any exemptions have been applied to any information that the school may provide, or whether any information has been withheld or the reason for the withholding of any information. A further exemption exists when information may be withheld in relation to the provision of examination marks before they are officially announced and copies of examination scripts.
The Academy Trust will not charge a fee for processing a Subject Access Request. However, if the Subject Access Request is either unfounded, excessive or repetitive the Trust may charge for dealing with the request by levying a “reasonable fee” to take into account the administrative costs of providing the information.
4. Processing by the School
Applications will be processed promptly, but in any event a response will be made within one month, as permitted under the General Data Protection Regulations 2018, from the date that the Trust accepts the properly completed application form along with your proof of identity, and any supporting documentation the Trust has requested from you. However, the Trust can extend the deadline by a further 2 months if a request is complex and numerous and applicants will be notified in writing within a month of receipt of the request, outlining the Trust’s reasons for the extended period.
Further guidance on Access to pupils’ information held by schools in England can be obtained from the Information Commissioner’s Office www.ico.gov.uk
5. About Yourself – Section 1 (The Data Subject)
The information about yourself will assist the Trust / School in finding the information you require. You should complete this section fully and carefully as the information will be used as the basis for our internal searches.
For your protection, any correspondence that the Trust / School sends you (including any information that the Trust / School sends to you in response to your request) will be sent only to the home address that you give in section 1.
Where you have submitted the request via any legal representative you are still required to complete the form in full and provide proof of identity. The Trust’s/ School’s response will be sent to your legal representative’s registered offices.
6. Proof of identity
The Trust / School has a duty to ensure that the information it processes is secure: the Trust / School will only provide the information relating to you if satisfied regarding your identity, i.e. that you are entitled to the information. The Trust / School therefore requires you to provide reasonable proof of your identity. Examples of the types of identity documents that the will be accepted are listed in the form. Applications that do not include acceptable identity will not be processed, but the School will contact you should this be the case.
The School does not have to give you any information that might identify any other individual unless that person agrees. If you believe that any information the School holds about you may identify another person, you may wish to obtain that person’s written consent (to you being given his/her information). That should be submitted to the School with this application, along with their proof of identity (to the same standard as is required for yourself).
7. Helping the School to find the information
In order to assist with the data information search, please give as much detail as possible. The guidance from the Office of the Information Commissioner states:-
“Data subjects frequently make open ended requests for access (‘Give me a copy of all the data you hold on me’). However, the Act [Section 7(3)] specifies that a Data Controller is not obliged to comply with a request unless he is supplied with such information as he may reasonably require in order to locate the information which that person seeks. In most cases an open ended request will not satisfy this provision”.
The Trust is unable to accept applications that have not been signed by the person whose details are supplied in Section 1. The Trust will not process any application unless it has been signed and dated.
10. Your Checklist
This is a brief checklist to ensure that you have completed the form properly.
When you have completed the form, please send it together with your proof of identity to:
Data Protection Officer
Hornbeam Academy Trust
Forms that are incomplete will be returned for the person to complete in more detail, together with an explanation for the form being returned to you.
Please click here to access the Subject Access Request form