Subject access request exemption assessment procedure

This procedure applies when a school considers withholding or delaying information in response to a subject access request (SAR). Each exemption, consultation route and conditional safeguard applies only where the facts of the request and the school's processing meet the relevant conditions. Exemptions must not be applied as blanket rules.

1. Assess the request case by case

Consider each possible exemption against the facts of the individual SAR. Do not routinely rely on exemptions or apply them as a blanket policy.

Record the exemption considered, the relevant facts, the information within scope, the information proposed to be withheld or delayed, and the reasons for the decision.

2. Identify information that can be disclosed

Identify the information to which the proposed exemption relates and separate any information that is not covered by the exemption for disclosure.

The decision-maker remains responsible for deciding whether personal information should be disclosed and whether an exemption can be applied. Any consultation must support, and not replace, that decision.

3. Consider explanations to the requester

Where possible, give the requester transparent reasons for withholding information. If explaining the exemption in detail could prejudice its purpose, provide a more general explanation instead and record why a detailed explanation was not given.

4. Consider consultation

Where the school is considering an exemption concerning prejudice to another organisation's function, it may consult that organisation before responding. Record the issue referred, the consultation request and response, and how the views informed the school's own decision and explanation.

Where the information is being used by, or shared to enable, a specified regulatory organisation's function and disclosure may prejudice that function, consultation with the relevant organisation may also be considered. If disclosure is not likely to prejudice the function, comply with the SAR.

Where consultation makes the request complex, consider whether the response period can be extended by up to two months, as described in the relevant guidance.

5. Management forecasting or management planning

Consider this exemption only where the personal information is relevant to, and is being used for, high-level management forecasting or management planning involving forward-looking strategic thinking or consideration. It does not apply merely because information concerns a particular employee or an ordinary personnel decision.

Before relying on this exemption, assess and record why the information is relevant to the management forecasting or planning purpose, why disclosure would likely prejudice the school's business or activity, and why that prejudice is greater than the harm likely to be experienced by the person from not having access to the information.

Apply this exemption selectively. Disclose information that is not covered by it and, in most cases, give the requester reasons for applying it.

6. Child-abuse information

Consider this exemption only in England where the SAR is made under a power conferred by an enactment or rule of law by a person with parental responsibility for a person under 18, or by a person appointed by a court to manage the affairs of someone incapable of managing their own affairs.

Identify whether the information concerns whether a person under 18 has been, is, or may be at risk of child abuse, including physical injury other than accidental injury, physical or emotional neglect, ill-treatment or sexual abuse.

Assess the child's best interests. The exemption applies only to the extent that complying with the request would not be in the child's best interests. Do not treat safeguarding or child-related information as automatically exempt.

7. Scientific or historical research and statistics

Consider this exemption only where personal information is used for scientific or historical research purposes or statistical purposes, and only to the extent that complying with the SAR would prevent or seriously impair those purposes.

Before relying on it, assess and record whether the processing is subject to appropriate safeguards for people's rights and freedoms, is not likely to cause substantial damage or substantial distress, is not used for measures or decisions about a particular person except in the stated approved-medical-research case, and does not make research results available in a way that identifies people.

8. Public-interest archiving

Consider this exemption only where personal information is used for archiving purposes in the public interest, and only to the extent that complying with the SAR would prevent or seriously impair that purpose.

Before relying on it, assess and record whether the processing is subject to appropriate safeguards for people's rights and freedoms, is not likely to cause substantial damage or substantial distress to any person, and is not used for measures or decisions about a particular person except in the stated approved-medical-research case. Ordinary school records and routine retention activities should not be treated as public-interest archiving without assessing these conditions.

9. Examination information

For information recorded by an examination marker, first establish whether the SAR was made before the examination results were announced. If it was, the information may be provided within five months of receiving the request or within 40 days of announcing the results, whichever is earlier.

If the SAR was made after the results were announced, do not rely on this exam-script exemption.

For information recorded by candidates in an examination, assess the request separately; the relevant guidance states that candidates do not have the right to a copy of their answers to the questions.

10. Complete and communicate the decision

Complete the case-specific assessment before responding. Confirm the information withheld or delayed, the exemption relied upon, the conditions considered, the reasons for the decision, any consultation undertaken, and the information separated for disclosure.

Respond to the requester with the information that can be disclosed and, where possible, transparent reasons for any withholding or delay. Where a detailed explanation could prejudice the purpose of the exemption, give a more general explanation and retain the reason for doing so.