Handling other information rights requests
How to manage other information rights requests, including changing, deleting or restricting the processing of personal information.
Information rights mean a person has the right to access or amend the personal data any organisation, such as a school, holds about them.
The most common type of information rights request is a subject access request (SAR). This is when someone requests to see the personal data an organisation holds about them. There is more information on to how to handle a SAR in a school.
Individuals, including children, have several information rights relating to personal data a school may hold about them.
Information rights request that someone might make include asking to:
- change inaccurate personal information you hold about them
- remove their personal information or record
- restrict the processing of their personal information
- stop processing their personal information (right to object)
You can receive an information rights request relating to personal data either verbally or in writing, including through social media.
Unless there’s a valid reason, you must respond to any information rights request within one calendar month. If the case is complex you can extend the response deadline by an extra 2 calendar months.
Information rights requests only apply to the personal data you hold when you get the request.
Individuals have the right to request changes or restrictions to personal information, but a school is not obliged to make changes to data in certain circumstances.
Your school should have procedures in place for responding to information rights requests. You should also make sure that all staff are trained to recognise different kinds of information rights request and know how to escalate a request if they receive one.