Secure subject access response delivery procedure

Use this procedure when supplying information in response to a subject access request. Delivery decisions should reflect the sensitivity of the information, the requester’s needs, the available channels and any recorded security considerations.

Select and check the delivery method

Review the delivery method requested by the requester and the channel through which the request was made. Consider whether the proposed method is suitable in light of any security concerns and the available alternative channels.

Record the delivery method considered, any security concern identified and the decision about how the response will be supplied.

Portal concerns

If there are concerns about supplying the information through a portal, including security concerns, contact the requester first where possible and make them aware of the concern.

If the requester agrees with the concern and is happy to receive the information directly, send the response directly to the requester rather than through the portal.

If the requester has asked not to be contacted directly, communicate through the portal that the response will be provided in an alternative format and invite the third-party representative to contact the school directly.

Requester-specified delivery methods

Where the requester asks for the information to be sent by another method, comply with that request where possible. Record the requested method, whether it was available, and the method used to provide the response.

Encrypted electronic delivery

Where encrypted electronic delivery is appropriate and available, consider providing the information in an encrypted format and sending the secure access code separately.

Record the decision to use encrypted delivery, retain the encrypted file or transfer record, and record that the access code was sent separately.

Complete the delivery

Send the response using the agreed or selected delivery method. Record the method used and retain the relevant delivery record, including any communication with the requester, portal or third-party representative.