SAR guide
SAR redaction checklist for schools
This checklist is a practical starting point for school SAR review work. It is not legal advice and should be adapted to your data protection policy.
1. Record the request
- Record the date the request was received.
- Record the requester, data subject and relationship to the data subject.
- Confirm whether the request is a pupil SAR, parent request for an education record or another access request.
- Record the request channel and the scope requested.
- Keep a note of any clarification requested and received.
2. Check identity and authority
- Check the requester is who they say they are where this is needed.
- Check authority for parent, carer, solicitor or representative requests.
- For older pupils, consider competence, consent and best interests.
- Escalate disputed authority or child consent questions to the DPO or senior reviewer.
3. Set the deadline
For most UK GDPR SARs, respond without undue delay and within one month. Complex requests or multiple requests can allow an extension of up to a further two months. If identity, a fee where allowed, or clarification is required, record how that affects the response time. For requests received on or after 5 February 2026, the Data (Use and Access) Act 2025 sets out in UK GDPR that the clock stops while you wait for clarification you genuinely need, and that searches must be reasonable and proportionate.
4. Collect evidence carefully
- Keep source files in a controlled folder and avoid changing originals.
- Export email evidence in a format your review tool can read, such as EML ZIP where possible.
- Keep attachments with their parent emails so families can be reviewed together.
- Record duplicate items and threads so reviewers do not waste time reviewing the same item repeatedly.
5. Search for likely identifiers
Search for names, email addresses, phone numbers, postal addresses, pupil numbers, dates of birth, NHS numbers, National Insurance numbers, staff names, safeguarding systems and case specific words.
Do not rely only on automatic matching. Handwritten notes, scanned documents, screenshots, tables and context dependent references need manual review.
6. Review redaction reasons
- Third party personal data may need redaction unless disclosure is appropriate.
- Safeguarding material may need serious harm or best interests review.
- Legal privilege, confidential references and management information may need specialist review.
- Information that is not the data subject's personal data may be outside scope.
- Record the reason for each redaction as you make it, not afterwards. RedactNinja lets you give every redaction a reason and builds a schedule of redactions from them.
- Decide whether the requester should see the reasons. A schedule without the redacted text can explain what was withheld and why.
7. Check outputs before disclosure
- Open the redacted PDF and search for key names and identifiers.
- Check pages with manual redaction boxes at full zoom.
- Check whether any PDF text layer remains behind covered areas.
- Keep an audit note of rules used, redactions made and review decisions.
- Have a second reviewer check complex, high risk or sensitive disclosures, and record who checked each page or email. If redactions change after the check, check those pages again.
- Check pictures, signatures and stamps as well as text: automatic text matching does not read them.