Individuals have various rights under the General Data Protection Regulations (GDPR) to access and understand personal data about them held by the school, and in some cases ask for it to be erased or amended or for the school to stop processing it, but subject to certain exemptions and limitations.
Any individual wishing to access or amend their personal data, or wishing it to be transferred to another person or organisation, should put their request in writing to the PCO.
The school will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time-limits, which is one month in the case of requests for access to information. The school will be better able to respond quickly to smaller, targeted requests for information. If the request is manifestly excessive or similar to previous requests, the school may ask you to reconsider or charge a proportionate fee, but only where Data Protection Law allows it.
You should be aware that certain data is exempt from the right of access. This may include information which identifies other individuals, or information which is subject to legal professional privilege. The school is also not required to disclose any pupil examination scripts, nor any confidential reference given by the school for the purposes of the education, training or employment of any individual.
Pupils can make subject access requests for their own personal data, provided that, in the reasonable opinion of the school, they have sufficient maturity to understand the request they are making (see below). Indeed, while a person with parental responsibility will generally be expected to make a subject access request on behalf of younger pupils, the information in question is always considered to be the child’sat law. A pupil of any age may ask a parent or other representative to make a subject access request on his/her behalf, and moreover (if of sufficient age) their consent or authority may need to be sought by the parent.Pupils aged 13 are generally assumed to have this level of maturity, although this will depend on both the child and the personal data requested, including any relevant circumstances at home. Children younger than 13 may be sufficiently mature to have a say in this decision. All subject access requests from pupils will therefore be considered on a case by case basis.
Where the school is relying on consent as a means to process personal data, any person may withdraw this consent at any time (subject to similar age considerations as above). Please be aware however that the school may have another lawful reason to process the personal data in question even without your consent.