Data subject access requests (DSARs) can be made under the General Data Protection Regulation (GDPR) or under the Data Protection Act 2018, but schools and colleges are increasingly showing concern regarding the effective way to deal with such requests. Most of the time, DSARs are coming from staff members, parents or pupils, but children have the same right of access to their personal data as adults. If the school or college is the data controller, it must respond to a DSAR within one month from the date it has been received. Asking for clarification is permissible, but only regarding what would reasonably be needed to find the personal data that the individual is seeking.
