Sort

• 25 May 2025

No

|

Simple

Dear MH,

You're most welcome.

Where a child is on roll at a school and an Education, Health and Care (EHC) needs assessment results in the issue of an EHCP, I struggle to support any view suggesting that the local authority is not obliged to consult the school in question prior to issuing the plan.

In my view, even if the pupil is already enrolled at the school, Section I of the draft EHCP should remain blank at that stage and must not specify a placement. That said, if the intention is for the child to remain at their current school the local authority is nonetheless under a  duty to consult the school before the EHCP is finalised. This obligation arises under the Special Educational Needs and Disability (SEND) framework and accompanying guidance.

In my experience, such consultations are seldom cursory. On the contrary, they typically allow the school to assess and confirm whether it has the capacity to meet the child’s needs and to identify any additional special educational provision that may be required. This process is particularly pertinent where the school is a mainstream setting where broadly suitability and cost factors are not relevant.

That said, if you wish to obtain a copy of the document in question—or any other pertinent records—you may consider submitting a Data Subject Access Request (DSAR). Further information is available on the Information Commissioner's Office (ICO) website via the following link:

https://ico.org.uk/for-the-public/schools/

It would be prudent to submit separate requests: one to the school and another to the local authority.

I have provided a brief overview of how the process operates, along with two template letters which you may find useful. However, I strongly encourage you to review the ICO guidance linked above for complete and authoritative advice.

If you intend to pursue this route, I would recommend acting without undue delay.

 

Summary

Under Article 15 UK GDPR and section 45 of the Data Protection Act 2018, parents may act on behalf of a child to obtain personal data held by public bodies, provided this is in the child’s best interests and the child lacks sufficient maturity to act alone, or consents to the parent doing so. Schools must also disclose the child’s education record under the Education (Pupil Information) (England) Regulations 2005, usually within 15 school days, while all personal data (emails, case-notes, safeguarding files, etc.) fall under the one-month DSAR deadline. Controllers may request proof of parental identity and authority, but only where reasonably necessary. A single, clear letter sent by email or post is enough; using the phrase “subject access request” triggers the statutory duties. If the request is complex the body may extend the deadline by up to two months but must tell you promptly and explain why

 

Key legal and practical points

1. Legal basis

• UK GDPR Article 15 gives every data subject the right of access. Parents may exercise that right on a child’s behalf when appropriate. 
• Data Protection Act 2018, s45 embeds Article 15 in UK law.
• Education (Pupil Information) (England) Regulations 2005 give an additional, shorter right of access to the education record (curriculum, assessment and SEN papers) for maintained and special schools.

2. Identity & authority checks

Controllers should verify identity only when proportionate: for example, by asking security questions or a copy of a driving-licence; demanding excessive documentation may breach the “data minimisation” principle.

3. Time-limits

• Education record: 15 school days. 
• All other personal data: one calendar month from receipt; may extend by two months if “complex”. 

4. Scope & exemptions

Data may be withheld where disclosure would reveal a third party’s personal data, legal advice, or serious harm, but the organisation must explain any redactions and cite the exemption relied upon.

 

Draft DSAR – Local Authority (Children’s Social Care)

[Parent’s full name] 

[Parent’s address] 

[Postcode] 

[Email address] 

[Telephone number] 

 

Data Protection Team 

[Name of Council] 

[Children’s Services Directorate] 

[Council address] 

[Postcode] 

 

[Date]

 

Re: Subject Access Request – [Child’s full name, DOB dd/mm/yyyy]

 

Dear Sir or Madam,

 

I am writing under Article 15 of the UK General Data Protection Regulation and section 45 of the Data Protection Act 2018 to request copies of all personal data held by [Council name] Children’s Services about my son/daughter, [Child’s name], date of birth [DOB].

 

I have parental responsibility, evidenced by the enclosed copy of [birth certificate / court order]. Please provide:

 

1. All social-care files (case notes, assessments, plans, minutes, emails, recordings) that contain my child’s personal data; 

2. Any personal data about me that appears *only* because it relates to my child’s case; 

3. A description of the purposes, recipients and retention periods for each dataset; 

4. An explanation of any automated decision-making or profiling; and 

5. The source of any data not collected directly from us.

 

If you consider any exemption applies, please identify the legal basis and supply a redacted copy of the material wherever possible, rather than withholding it in full.

 

Please send the response electronically (PDF) to the email address above. If you require further information to confirm my identity or parental responsibility, kindly let me know immediately so I may supply it.

 

I look forward to your response within one calendar month of receipt, as required by UK GDPR. 

 

Yours faithfully,

 

[Parent’s signature] 

[Printed name]

 

Draft DSAR – School (Mainstream or Special)

[Parent’s full name] 

[Address] 

[Postcode] 

[Email] 

[Tel]

 

The Headteacher 

[School name] 

[School address] 

[Postcode] 

 

[Date]

 

Re: Subject Access Request & Request for Education Record – [Child’s name, DOB]

 

Dear Headteacher,

 

I act on behalf of my son/daughter, [Child’s name], who attends Year [X] at your school. Under:

 

• Article 15 UK GDPR and section 45 Data Protection Act 2018 (subject access); and 
• Regulation 5 of the Education (Pupil Information) (England) Regulations 2005 (education record),

 

I request:

 

A. Full education record: 

copies of all documents comprising my child’s official education record, including attainment data, progress reports, Individual Education Plan / SEN support records, safeguarding or behaviour logs and any exclusions paperwork.

 

B. All other personal data:

any emails, notes, counselling or pastoral files, CCTV footage and medical information that identify my child.

 

Please supply the information in electronic form (PDF/Word) to the email address above. If any exemptions apply, please redact only what is necessary and explain the legal justification clearly.

 

I understand that the education record should be supplied within 15 school days and the remainder of the personal data within one calendar month of receipt of this request.   

 

Should you require proof of my identity or parental responsibility, please inform me without delay.

 

Thank you for your assistance.

 

Yours sincerely,

 

[Parent’s signature] 

[Printed name]

 

Final checks before sending

• Attach proof of identity/parental responsibility if the body’s privacy notice demands it.
• Keep a copy of each request and note the date delivered/emailed.
• Chase politely if no acknowledgement arrives within a week.
• If the deadline passes, you may complain to the organisation first, then escalate to the ICO.
•  Note, limiting the scope of the request may reduce the chances of the body to whom the request is sent claiming they need more time. 

 

 



Sean Kennedy

25 May 2025

This is helpful

|

2 Comments

Post