Subject access request clarification, identity and accessibility procedure

Application

This procedure applies conditionally to maintained and academy primary and secondary schools in England when a subject access request requires clarification, identity verification, accessibility adjustments or assessment alongside another data-protection rights request. The responsible role is [data protection case handler role].

Requesting clarification

Where clarification about the personal information requested is needed, seek and obtain it through a process that is quick and easy for the requester. Provide advice and assistance to help the requester clarify the request.

Explain that the response clock stops from the date clarification is requested and resumes on the day after the requester responds. Specify any time by which the requester needs to reply, using the school’s actual case-management arrangements.

Where possible, contact the requester in the same format in which the request was made. For example, where the subject access request was sent by email, send the clarification request by email.

Identity information

Where further information is needed to verify the requester’s identity, request the identity documents or other requested information as soon as possible and avoid unnecessary delay.

The response timescale does not begin until the requested identity information has been received. Record when the identity information was requested and when it was received so that the response timetable can be calculated.

Where a third party is acting on behalf of the requester, establish the third party’s authority where relevant. This identity or authority step may also apply to other data-protection rights requests received at the same time.

Accessibility and reasonable adjustments

Where the school is aware that the requester may require reasonable adjustments because of a disability, communicate with the requester before responding to find out how best to meet their needs.

The adjustment should reflect the requester’s specific needs. Where appropriate, provide the response in an accessible format suited to those needs, such as large print, audio, email or Braille.

No response to a clarification request

If the requester does not respond to a clarification request, wait for a reasonable period before considering the subject access request closed. One month is generally reasonable, but apply a proportionate and reasoned approach rather than treating the period as automatic.

Before deciding whether the request may be treated as closed, consider whether the requester might have difficulty providing the additional details within the specified period. Accommodate the requester as much as possible where there are complex issues or accessibility considerations.

Record the clarification request, the period allowed for response, any follow-up or accessibility considerations and the reasoned closure decision.

Concurrent data-protection rights requests

Where the requester makes a subject access request at the same time as a request concerning another data-protection right, deal with each request separately.

Identify any steps that may apply to all the requests, such as establishing proof of identity or confirming that a third party has authority to act on the requester’s behalf. Do not treat the shared step as replacing the separate assessment of each request.