Third-party portal and authorised representative SAR procedure

This procedure applies where a subject access request is made by an authorised representative or through a third-party portal, particularly where the school cannot contact the requester directly or the request concerns a child or sensitive information.

1. Requests made by an authorised representative

When a third party is authorised to act, first determine whether the response should be sent to the representative or directly to the person concerned. Take account of the person’s wishes and any reasonable concern about excessive or sensitive disclosure.

Where the school is satisfied that the third party has the appropriate authority, the response should normally be sent directly to the representative.

If there are reasonable grounds to believe that the person may not understand the nature of the information being disclosed, and there is concern about revealing excessive information to the representative, contact the person first where possible. This may be appropriate where the information is particularly sensitive or the person may not know the extent of the information likely to be disclosed.

If the person agrees with those concerns and is happy to receive the information directly, send the response directly to that person rather than to the representative. If the person asks for the information to be sent to the third-party representative, send it to the representative.

2. Requests submitted through a third-party portal

Where the request has been submitted through a third-party portal and the school cannot contact the person directly, advise the portal that the school will not respond until it provides evidence that it is acting with the authority of, and on behalf of, the person. This evidence may involve identity checks.

Also require evidence that the person has agreed to the information being uploaded to the portal. Do not treat the request as valid, or start the time limit, until the requested details have been received.

3. Recording the decision

Record the request, the authority information requested and received, any evidence of the person’s agreement to portal uploading, and the date on which a valid request was established.

Record the authority assessment, the person’s wishes where obtained, the decision about whether to send the response to the representative or directly to the person, any concern about excessive or sensitive disclosure, and the method used to transmit the response.