Third-party subject access request disclosure decision record
- Version
- v1
- Updated
- 7 October 2026
- Reviewed
- 7 October 2026
- Audience
- Data protection leads, subject access request handlers and authorised staff in maintained and academy primary and secondary schools in England.
- Jurisdiction
- england
Blank fields · read-only preview
1. Request and record details
Complete this record when a subject access request includes, or may include, information about another person. Record the reasoning for the decision, including any decision not to seek consent.
Subject access request reference
RequiredUse the school's internal reference or case identifier. Do not enter unnecessary personal information.
Enter the case reference
Date the subject access request was received
RequiredEnter the date on which the school received the request.
- Day
- Month
- Year
Decision-maker
RequiredName or role of the person who made or approved this disclosure decision.
Enter name or role
Date of disclosure decision
RequiredEnter the date on which this decision was made or approved.
- Day
- Month
- Year
Category of third party whose information is involved
RequiredSelect all categories that apply. Use the other option only where none of the listed categories is suitable.
Choose all that apply
- Pupil
- Parent or carer
- Staff member
- Visitor
- Professional or service provider
- Other third party
- Other
If other, please specify
Description of the third-party information involved
RequiredDescribe the information sufficiently to identify what was assessed without reproducing unnecessary personal data.
Describe the information considered
Source or location of the information
RequiredIdentify the relevant record, system, correspondence or document location.
Enter the source or location
2. Consent assessment
Consent position
RequiredRecord the position applicable to this request. Seeking consent is optional and may be inappropriate in some circumstances.
Choose one
- Consent was already obtained
- Consent was sought for this request
- Consent was not sought
- Consent could not be obtained or the response was unavailable
- Consent assessment is not applicable to the information considered
Date consent was requested
Complete only if consent was sought for this request.
- Day
- Month
- Year
Consent request outcome
Complete only if consent was sought or a consent response was received.
Choose one
- Consent given
- Consent refused
- No response received
- Consent withdrawn
- Response was unclear or incomplete
Consent evidence or record location
Complete if consent was obtained, requested or responded to. Identify where the evidence is stored.
Enter the record location
Reasons consent was not sought or seeking it was inappropriate
Complete if consent was not sought or could not appropriately be sought. Explain the circumstances and the reasoning.
Explain why consent was not sought or was inappropriate
3. Disclosure assessment
Factors considered in deciding whether disclosure is reasonable
RequiredSelect all factors considered and explain their significance in the reasoning field below.
Choose all that apply
- Third-party consent or refusal
- Nature and sensitivity of the information
- Relationship between the requester and third party
- Reasonable expectations of the third party
- Confidentiality or duty of confidence
- Potential harm or distress
- Risk of identifying the third party
- Other relevant factor
- Other
If other, please specify
Reasonableness and disclosure assessment
RequiredExplain why disclosure with consent, disclosure without consent, partial disclosure, redaction or withholding is reasonable in the circumstances.
Set out the assessment and reasoning
Could information be provided without identifying the third party?
RequiredConsider whether editing or redaction could remove information that identifies the third party while providing as much requested information as possible.
Choose one
- Yes
- No
- Uncertain
4. Outcome and response
Decision outcome for the third-party information
RequiredSelect the outcome that applies to the information assessed.
Choose one
- Disclose in full
- Disclose in part
- Disclose after redaction or editing
- Withhold the third-party information
- No third-party information identified after assessment
Redaction or withholding applied
Complete if information was partially disclosed, redacted, edited or withheld. Describe what was removed or withheld and why.
Describe the redaction, editing or withholding
Information disclosed
RequiredSummarise the third-party information actually provided, or state that none was provided. Do not duplicate unnecessary personal data.
Summarise what was disclosed
Response to the requester
RequiredRecord how the requester was informed of the outcome, including where information was withheld or redacted.
Choose all that apply
- Response issued with the information
- Response issued with partial information
- Response issued with redactions or editing
- Withholding explained in the response
- Response not yet issued
Date response was issued
Complete if a response has been issued to the requester.
- Day
- Month
- Year
Final justification for the outcome
RequiredProvide a concise final justification linking the evidence and assessment to the decision recorded above.
Explain the final decision
Further review required
RequiredSelect whether the record requires review by another authorised person before closure.
Choose one
- Yes
- No
Review or closure notes
Record any approval, escalation, follow-up action or record-management note.
Enter review or closure notes