Handling Subject Access Requests (SARs) (Knowledge Bank subscribers) involving pupils is rarely straightforward. A recent helpdesk scenario put a school in a particularly difficult position: a 14-year-old pupil disclosed that her parents had pressured her into signing a form authorising them to request her personal records.

When a child tells you they were pressured into signing, what comes first, and where does the school stand?

Safeguarding comes first

A disclosure that a child has been pressured or coerced at home is a safeguarding matter before it is a data protection one. Refer it to your Designated Safeguarding Lead straight away, in line with KCSIE and your child protection policy. The DSL's view should shape how, and whether, the SAR response goes ahead.

The right of access belongs to the child

Parents do not have an automatic right to their child's personal data under UK GDPR. The right of access is the child's own. A parent can exercise it on the child's behalf only if:

• the child is not competent to act for themselves, or
• a competent child has genuinely authorised the parent to act for them.

If a pupil tells you that authorisation was obtained under pressure, you should not treat it as genuine. The parent may not be entitled to act on the child's behalf.

Pupils can only exercise their rights if they understand them. Child-friendly privacy notices help young people understand what the school holds about them and what they can do about it.

Assessing competence

In England, Wales and Northern Ireland, there is no set age at which a child can exercise their own data protection rights. Instead, each child is assessed on their maturity and understanding. In Scotland, a child aged 12 or over is presumed to be competent, and the ICO considers this a reasonable approach elsewhere too. The Department for Education uses 13 as its reference point. Neither age is a legal threshold in England, Wales or Northern Ireland; each is a guide to support, not replace, an assessment of the individual child.

Schools usually know the child well, so they are well placed to make this judgement. If a child is competent, the rights belong to them. A parent can then act on their behalf only with the child's agreement, or where doing so is clearly in the child's best interests. Take extra care where the information is special category data or relates to safeguarding.

Even when a parent is acting on a child's behalf, the ICO expects you to weigh up:

• any risk to the child from releasing the information, especially where there are concerns about abuse or ill-treatment
• any harm to the child if the parent cannot access it
• the child's own views

Don't forget the educational record

In maintained schools in England, parents have a separate right to their child's educational record under the Education (Pupil Information) (England) Regulations 2005. This right is not a SAR and does not depend on the child's authority, but it has its own limits. Academies and free schools are not covered by these regulations.

Not sure which route a request falls under? Our free Data Request Type: SAR, ER or FOI? guide helps you identify it.

The risk of getting it wrong

If a school releases a pupil's records to a parent, knowing the pupil's authority was obtained under pressure, that could be an unauthorised disclosure and a personal data breach. Depending on the risk to the child, it may need reporting to the ICO. In a case like this, the risk may be significant.

What should schools do?

1. Refer to the DSL first. Treat the disclosure as a safeguarding concern before anything else.
2. Check the authority is genuine. Before releasing a competent pupil's data to a parent, confirm privately with the pupil, and without parental pressure, that they agree.
3. Take care with the response. If you decline, the one-month deadline still applies to your response to the requester. Word it carefully, with your DPO and DSL, so it doesn't put the child at risk or reveal what they told you. DPE clients can contact their DPO through DPO Support.
4. Remember the child's own rights. The pupil can make their own SAR, or authorise someone else to act for them.
5. Record your reasoning. Keep confidential notes of the competence assessment, what the pupil said, the DSL's input, and why you declined or paused the request.

Want your staff to be confident spotting and handling requests like this? See our training and consultancy.

Further reading

• ICO: What about requests for information about children?
• ICO: Education information
• DPE: Subject Access Requests best practice (Knowledge Bank subscribers)
• DPE: Data Request Type: SAR, ER or FOI? (free download)