Stone King Guide: Handling Subject Access Requests

A practical guide for educational establishments receiving subject access requests in relation to Summer 2020 exam results

The 2020 exam grading system is likely to provoke a significant volume of subject access requests (SARs) made by students wanting access to their assessment grades, rankings and related personal data.  GDPR gives students a legal right to request this information although because of the operation of a legal exemption within the Data Protection Act 2018, it is unlikely that they will be able to access it until after their exam results have been announced.

Educational establishments are becoming increasingly concerned at the volume of SARs they might have to comply with in a short timeframe and are considered how best to manage this.

Stone King’s practical guide on handling a SAR in the context of the Summer 2020 exam results contains detailed guidance, template responses, FAQs and Key tips.

Developed by specialist Information lawyers, this Guidance pack includes:

  • How to identify if the SAR is legally valid
  • An overview of your legal obligations as a controller including time limits for responding to a SAR and circumstances in which those time limits can be extended; how to approach requests made by parents on behalf of students; dealing with “bulk” requests made by multiple students in close proximity to each other; verifying identity of the requestor and requesting clarification of a request.
  • How to identify personal data in the context of handling a SAR
  • Applicable exemptions – an overview of some of the most applicable legal exemptions from the right of access under the Data Protection Act 2018 (“DPA”).
  • Template responses – various templates to be adapted for use where a SAR is received, including an acknowledgement of receipt and a substantive response to a SAR.
  • Practical tips on effectively dealing with a SAR
  • Answers to questions such as “Can we extend the deadline for dealing with the SAR?” “Will anonymised or pseudonymised information be exempt from a SAR?” “Can we delete records generated as part of the grading and ranking process that we don’t have to deal with SARs? ”We’ve received a SAR from a parent on behalf of a student. The parent doesn’t live with the student. What do we do?” “Does the SAR include personal data held on a teacher’s personal device?”


£950 plus VAT (or £850 plus VAT for Education retainer clients and Stone King membership partner organisations)

How to order

Please click the following link and complete our Subject Access Request – Order Form.

Forthcoming Events

There are currently no events relating to this specific service, please follow the link above to view all our upcoming events.

The Legal 500 - The Clients Guide to Law Firms

UK Chambers logo

Best Companies - One to watch logo

Cyber Essentials Certification Logo