Subject access request response completeness checklist

Determine whether the enquiry can be answered quickly through a routine business process or whether it requests a substantial records search and should be handled through the subject access request process. Confirm that routine processes have not restricted or delayed access to personal information.

Record the requester, the person whose personal information is sought, the date received, and the information or records covered by the request. Where the requester is acting for another person, record the basis on which the request is being handled.

Review the information within scope and identify which information relates to an identifiable living person and whom each item relates to.

Define the records, systems, locations and relevant custodians to search. For a broad or unclear request, focus first on the main enquiries and then carry out a reasonable search for the remaining information.

Carry out the planned search and record the sources searched, search terms or parameters used where relevant, the people consulted, and any limitations or unavailable records.

Identify records containing information about both the requester and another person. For each relevant item, consider whether an exemption applies before disclosure and record the outcome.

Where records contain information relating to another person, identify the third-party information and consider the applicable exemption before including or withholding it. Complete this item only where third-party information is present.

Prepare a response that confirms whether the school is processing the person's personal information, provides a copy of that personal information, and addresses any specific information requested, subject to applicable exemptions.

Check that the response includes, where applicable, the purposes of processing; categories of personal information; specific recipients or recipient categories; retention period or criteria; relevant individual rights; complaint routes to the controller and ICO; source information where data was not obtained directly; automated decision-making information; and safeguards for international transfers.

Where specific recipient identities are not provided because it would be impossible, manifestly unfounded or excessive, check that recipient categories are provided instead. Complete this item where recipient information is relevant to the response.

Complete the examination-information checks only where the request concerns information recorded by an examination marker, the request was made before results were announced, and the school conducts the relevant examination.

Where the examination-information exemption is applicable, record the request date, the result-announcement date when known, and the deadline calculated as the earlier of five months after receiving the request or 40 days after announcing the results. If the request was made after results were announced, do not rely on this exemption.

Where the request includes information recorded by the candidate in an examination, check how that information has been treated in the response. Complete this item only where examination answers are within scope.

For every item withheld, redacted or otherwise excluded under an exemption, record the information affected, the exemption relied on, the reason it applies, and how the decision was reached. Complete this item where any exemption is used.

Check that the response contains the applicable confirmation, copy of personal information, supplementary information, treatment of mixed and third-party information, documented exemptions and reasons, and any examination-information deadline or tracking record required for this request.