Secure SAR disclosure procedure

This procedure applies to schools disclosing information in response to subject access requests (SARs). The selected delivery method and security controls should reflect the sensitivity of the information, the requester’s needs and the communication channels used.

1. Select the delivery method

Select a secure method for sending the information. The available method should reflect the information sensitivity, the requester’s needs and the communication channels used.

A trusted courier may be used where appropriate. If the information is provided in hard copy, consider whether special delivery or a courier service is appropriate, taking account of the nature and sensitivity of the information.

2. Check the recipient and response before dispatch

Before sending information by email, check the recipient email address. Review the response before dispatch and correct any identified issue before sending.

Before sending information by post or courier, check the delivery details and confirm that the selected service is appropriate for the information’s nature and sensitivity.

3. Alternative methods, formats and adjustments

Make it clear that the requester has a right to ask for their information in a different format.

If the requester is unable to, or does not want to, use a secure online platform, respond to the SAR using an alternative method.

Consider making reasonable adjustments where necessary. If the requester makes a reasonable request for an alternative format, comply where possible.

4. Concerns about the requested delivery method

If the delivery method requested by the person raises security concerns, contact the requester, explain the concerns and ask for an alternative method of providing the information.

Record the delivery-method discussion, the concerns raised, any alternative method agreed and the basis for selecting a postal or courier service where hard-copy information is sent.