As the academic year draws to a close, schools often face an influx of data requests, particularly Subject Access Requests (SARs) and Freedom of Information Requests (FOIs). Managing these effectively, especially with the imminent summer holidays, can be daunting. However, with the right approach and preparation, schools can handle these requests efficiently and transparently.
Key Timescales Differences
Subject Access Requests (SARs)
For Subject Access Requests, the statutory deadline to respond to the request is one calendar month. This date begins on the exact date of receipt and there is no official, statutory guidance for extending the deadline due to school closures. There is guidance on when situations may arise where an extension is deemed proportionate and/or necessary.
Freedom of Information Requests (FOIs)
For Freedom of Information Requests, the statutory deadline to respond is 20 school days (or 60 days – whichever is shorter). Therefore, there is a statutory requirement that considers closure periods in which schools will take additional time to fulfil the request.
For both requests, your Data Protection Officer (DPO) would assist you in drafting a formal acknowledgement to set the deadline and request ID, clarification and/or consent where appropriate. They would also draft a final response once the data has been collated and is ready to send.
Handling Data Requests During School Closures
Below are some helpful tips on how best to prepare for SARs, especially when received while the school is closed, or when minimal staff is available on site.
Consistency
Judicium advises schools to create a checklist for staff to use. The checklist can be drafted by a DPO or key contacts within the school. It sets key areas that must be considered when carrying out a SAR. Not all SARs will be the same, but having a starting point with a list of areas to check will help when carrying out a “reasonable” search.
Structured
Judicium’s best practice advice is to maintain organised, structured data within your organisation. For instance, ensure your systems are managed effectively. Have processes in place such as only communicating about staff with initials or codes (similarly with pupils). This means when a SAR is received, it is more likely to be reasonable to search with the same processes you apply.
Accountable
This can apply in two ways:
The organisation is accountable for ensuring requests are complied with, not individuals. Judicium advises sharing the responsibility and dividing tasks to ensure this can be completed within the deadline.
To ensure accountability, Judicium advises maintaining an accurate request log and updating this with any extensions, reminding yourself of the deadlines to complete.
Minimised
A key area that will assist in preparing for any data requests is retention. Only retain data for as long as necessary for your intended purpose. Have an email retention policy in place and review with your DPO how long it is necessary to store data. Being transparent about retention processes and not storing data longer than necessary is highly beneficial for SARs.
Transparency During Closure Periods
It is important to always be transparent with the requester and to set reasonable expectations of when you will be able to provide them with the full response.
There is no statutory rule on extending SARs because of closures. During the summer term in particular, if you are not able to deal with the request, you should let the requester know the following immediately:
- Why you can’t deal with the request
- The length of the delay
- When you expect the response to be ready by
- Whether any information can be provided to them sooner
Practical Steps to Notify Requesters of Any Delays
Communicate in Advance
- Send a newsletter or communication to parents and staff, or place a notice in the reception area.
- Highlight that during closures, emails may or may not be monitored, which may impact the compliance with statutory deadlines for SARs and data requests.
Out of Office Message
- Clearly state the dates your school is closed.
- Indicate whether the inbox will be monitored.
- Provide a relevant alternative contact who can monitor communications throughout the period.
- Designate a key contact who will be working throughout the closure as the primary person for out-of-office responses.
Extension Wording
- Review extension wording with your DPO to ensure transparency with requesters about any potential delays.
- Dedicated Data Protection Inbox
- Set up a dedicated data protection inbox to make SARs easier to acknowledge and prevent them from getting lost within generic emails.
Policy Updates
- Clearly outline your process for handling requests during school closures in your policies, especially for summer periods.
- If you are subscribed to our Data Protection service, ensure that this information is integrated into your data policies.
NB: The test for requiring an extension remains strict. Due to the legal restrictions, we recommend seeking advice from your DPO. If you are a Judicium Data Protection client, we will assist in drafting any appropriate wording.
When Can Schools Extend an SAR Deadline?
Judicium has held discussions with the Information Commissioner’s Office (ICO) directly on this matter. The ICO confirmed they are sympathetic to schools for the strict approach that has been adopted regarding extensions during closure periods. However, an extension would only apply under the ‘complex request’ exemption as long as you had the correct processes in place, and you are being transparent.
This can only apply if the school is closed and there are no qualified staff on site to handle the SAR within the one calendar month.
NB: This also applies if someone works across the period but doesn’t have access to the information to prepare all the requested data.
If you can, set out to the requester what data you can reasonably provide earlier and what will require additional time due to closure constraints. For instance, if some staff do have remote access and are able to provide some information, evidence your taking steps to action within the initial statutory timeframe.
Of course, the complex exemption cannot be applied as a blanket exemption, but the reasoning just explored must be met. Therefore, for requests at other points throughout the year, may not be able to apply this just because they have requested a lot of information. For instance, if a request is over a half term, there might still be an expectation this can be fulfilled if staff are on site and you have taken steps to be prepared and organised to deal with this.
How Can a SAR Appendix in Your Data Policy Help?
It is essential you are including wording of your SAR processes within your policies. You can be transparent that during closures, you may require an extension as no staff will be on site to complete the request within the one calendar month.
The requesters will have this expectation from the outset and will be less likely to refer their request on to the ICO due to the delay.
NB: Speak to your DPO to draft the wording and to ensure it is specific.
The Benefits of a Clear Retention Policy for SARs
Keeping a record of your processing activities is a legal requirement. We recommend using a data map to review the purposes for holding data and the lawful basis for its retention. If data is stored without a valid purpose, it could breach the key principle of ‘data minimisation,’ and data you hold longer than necessary will still be subject to data subject access requests.
Staff Awareness and Retention Policies
Ensure that staff are informed about data retention periods, referring to your data retention policies or processes. This includes general file management and the duration for which staff records should be kept after they leave the school.
Data Storage Areas
Emails
- Implement a two or three-year retention period for emails.
- Data that no longer serves a purpose should be deleted.
- For emails that need to be retained longer, store them in a more organised manner in your MIS, safeguarding systems, server, or folders.
- Note that emails are often requested in SARs. Without a retention policy, searches can yield thousands of results, which may justify requesting an extension, though guidance remains strict.
Software
- Data entered into software systems may constitute personal data.
- Take steps to remove data of leavers from systems (where possible) by:
- Restricting use and managing access rights.
- Removing their data to ensure compliance.
Top Tips:
- Utilise the summer period or quieter times to carry out the deletion of data and to review your HR and pupil records to ensure only necessary data is being kept.
- Your retention policy should be easily accessible and have best practice guidance in place for staff to test what information may need to be held for longer.
- Provide guidance on where to store emails when necessary to move away from emails becoming the filing system.
What About Requests for Exam Information Before Results Day?
The simple answer is no.
The ICO have confirmed SARs requesting this data do not need to be answered until after issuing the exam results.
We would advise sending a response to the requester to confirm the results will remain confidential until after they have been issued. You can confirm you will contact the requester after the results are published to determine whether they still want to proceed with the subject access request. Your DPO should assist you in this.
Key Takeaways
- Set guidance throughout the year to help with the requests that come in these closures.
- Be transparent with the requester.
- Be confident and contact your DPO with any questions.
Additional Info
Judicium also offer a range of GDPR e-learning training designed for schools. You can see current course availability here.
You can find information regarding our School Data Protection Officer (DPO) service here.
Jedu is Judicium’s online GDPR compliance tracking software for schools. Our platform is suitable for single schools to large MATs and is designed to assist schools with two critical needs: To enable trustees, Governors and other SLT to monitor GDPR compliance; and to assist you managing your data protection.
If you would like more information on how we can support you or more information regarding Jedu, please get in touch with us.
If you require any support in any of these steps or would like to talk to someone surrounding some support for your school, please do not hesitate to call us on 0345 548 7000 or email georgina.decosta@judicium.com.