How to make Subject Access Requests: Find out what is stored in the National Pupil Database (NPD) about you or your child

You may want to ask the Department for Education what they hold about you or your child, in records stored since 1996. The Department to date refuses parents’ requests. We believe they have no legal basis to do so and should comply with Subject Access requests under the Data Protection Act 1998. As standard procedure for now, requests cost £10 per individual person the data is about. i.e. a parent of three children would need to pay £30 in total. You may want to make only one request, to start with, and see if the data you receive is what you expect first. Under the General Data Protection Regulation from May 2018, requests will be free of charge to ‘Data Subjects’ – that means you, or the person the data is about.

The DfE therefore offers no template to make requests although they do publish an email address to which you can submit them. We have therefore drafted a suggested template or we suggest you copy and paste the text from the bottom of this page, into an email. This is NOT an official DfE request form. Make the request by telling them who you are and what data you want, about yourself or your children, but do not send copies of any requested documents or cash until you know they have responded and accepted to process your request.

Despite this, and as published on the DfE website, you can email requests to them via: NPD.Requests@education.gov.uk

Reminder, it is very important that you do not send any copies of identity documents and do not  send £10 until requested to do so and AFTER the NPD request team has confirmed that they will process your request.

Here are questions and answers we get asked most frequently.

1. Can I access my personal information?

You have the right to get a copy of the information that is held about you. This is known as a subject access request.

This right of subject access means that you can make a request under the Data Protection Act to any organisation processing your personal data. The Act calls these organisations ‘data controllers’.

You can ask the organisation you think is holding, using or sharing the personal information you want, to supply you with copies of both paper and computer records and related information.

As a rule, organisations may charge a fee of up to £10. There are special rules that apply to fees in certain circumstances. There are some ‘exemptions’ within the Act which may allow an organisation to refuse to comply with your subject access request in certain circumstances. Consider carefully what you are asking to see. Remember that these data may be sensitive such as indicators of a child’s history of in-care, adoption, or parents’ service personnel status.

2. Can I access personal information about my child?

Information about children may be released to a person with parental responsibility. However, the best interests of the child will always be considered.

Even if a child is very young, data about them is still their personal data and does not belong to anyone else. It is the child who has a right of access to the information held about them.

Before responding to a request for information held about a child, organisations should consider whether the child is mature enough to understand their rights. If the organisation is confident that the child can understand their rights, then it will respond to the child rather than the parent. What matters is that the child is able to understand (in broad terms) what it means to make a subject access request and how to interpret the information they receive as a result of doing so.

Read more about subject access rights for children from the Information Commissioner’s Office.

3. Can I access personal information on someone else’s behalf?

Yes. The Data Protection Act does not stop you making a request on someone else’s behalf. This is often necessary for a solicitor acting on behalf of a client, or it could simply be that an individual wants someone else to act for them, like parents and children.

In these cases, the organisation will need to satisfy itself that the third party making the request has the individual’s permission to act on their behalf. It is the third party’s responsibility to provide this evidence, which could be a written authority to make the request, or a power of attorney.

If a person does not have the mental capacity to manage their own affairs and you are their attorney, for example you have a Lasting Power of Attorney with authority to manage their property and affairs, you will have the right to access information about the person you represent to help you carry out your role. The same applies to a person appointed to make decisions about such matters:

In England and Wales, by the Court of Protection;
In Scotland, by the Sheriff Court; and
In Northern Ireland, by the High Court (Office of Care and Protection).

4. How do I make a request?

To make a subject access request, you may wish to use  our suggested template or copy paste the text from the bottom of this page, into an email. This is NOT an official DfE request form, but has been drafted by us at defenddigitalme because the Department for Education do not offer one. As published on the DfE website, you can email requests to them via: NPD.Requests@education.gov.uk

However do not send any copies of identity documents and do not  send £10 until requested to do so and AFTER the NPD request team has confirmed that they will process your request. To date, they have refused requests from parents. We believe they should comply with Subject Access Rights under the Data Protection Act 1998.

Keep copies and proof of receipt.

It is best to send your request by email, and you should keep a copy of the request and all other correspondence. This will be important as evidence if you need to complain to the Information Commissioner’s Office that the organisation has not given you the information you think you are entitled to.

5. Do I have to make the request in writing?

Yes. A request sent by email or fax is as valid as one sent in hard copy. You can also make a valid request by social media, for example via an organisation’s Facebook or Twitter account, although it may be impractical for the organisation to use this same method to supply information to you.

If you find it impossible or unreasonably difficult to make a request in writing, an organisation may have to make a reasonable adjustment for you under the Equality Act 2010 (or Disability Discrimination Act 1995 in Northern Ireland). This could mean, for example, that the organisation has to consider treating a verbal request for information as if it was a valid subject access request.

6. What can I expect from the organisation?

The organisation has to reply within 40 days, starting from the day they receive both the fee and the information they need to identify you and the information you need. A credit reference agency must reply within seven days to a request for a credit file.

If an organisation reasonably needs more information to help them find your information or identify you, they have to ask you for the information they need. They can then wait until they have all the necessary information as well as the fee before dealing with your request.

7. What should the Department for Education send me?

What is held in the National Pupil Database is NOT the same as what is only held by your child’s school. Do not be put off by replies which tell you to ask a school for your child’s school record if you want to know what is held at national, not local level. You are entitled to be told if any personal information is held about you and if it is, to be given:

  • a copy of the information in permanent form;
  • an explanation of any technical or complicated terms;
  • any information the organisation has about where they got your information from;
  • a description of the information, the purposes for processing the information and who the organisation is sharing the information with; and
  • the logic involved in any automated decisions (if you have specifically asked for this).

8. Can the organisation withhold any information?

Yes. There are some circumstances where the information you have asked for contains information that relates to another person. Unless the other person gives their permission, or it is reasonable in all the circumstances to provide the information without permission, the organisation is entitled to withhold this information.

The law covers personal information that:

  • is held, or going to be held on computer;
  • is in, or going to be in, a manual filing system that is highly structured so that information about you can be easily retrieved;
  • is in most health, educational, social service or housing records; or
  • is other information held by a public authority

9. What can I expect if I have rights under the Equality Act 2010 (or Disability Discrimination Act 1995 in Northern Ireland)?

Under equality law an organisation has a duty to make sure that its services are accessible to all service users. You can request a response in a particular format that is accessible to you, such as Braille, large print, email or audio format.

10. What can I do if the organisation does not respond?

If more than 40 calendar days have passed since you made your request, we advise you write to the organisation to remind them of your request and their obligations under the Data Protection Act. We recommend you send any correspondence by recorded delivery.

After this, you can write to the Information Commissioner’s Office to complain and ask for support. Get in touch with us too. We are happy to discuss and support any questions before you make applications in confidence.


More Information

The information is only a guide and further information about the Data Protection Act 1998 can be obtained from the Information Commissioner’s Office website.

For the public: See ICO https://ico.org.uk/for-the-public/personal-information/  who also have a helpline
For organisations: https://ico.org.uk/media/for-organisations/documents/1065/subject-access-code-of-practice.pdf


Suggested Subject Access Request from the National Pupil Database

Please note that where the term “data subject” is used it refers to the person about whom the information is being requested. A parent, or guardian, who has joint, or sole, parental responsibility can make a request on behalf of their child, though this is dependent upon the age and maturity of the child.

The Data Controller (the Department for Education) must respond promptly and within 40 calendar days of the latest of the following:

  • On receipt of the request
  • On receipt of satisfactory proof of identity and required payment

Before you start, are you asking for data about yourself? If yes, you are called ‘the Data Subject’. (Please state)

if you are the Data Subject you will be asked to supply original proof of identity bearing  your name i.e passport, driving licence (if applicable), birth certificate (or certified copy) or at least 2 official letters such as from a utility company or Bank.  You may also be asked to provide a stamped addressed envelope for returning the document(s). DO NOT SEND THESE UNTIL ASKED TO DO SO.

If no, are you acting on behalf of the Data Subject with their written authority? If so, that authority must be enclosed and you must also produce evidence of your identity and that  of the data subject (as above). DO NOT SEND THESE UNTIL ASKED TO DO SO.

Please complete the questions and declaration below.

1.        Details of the Data Subject (who the data request is about, if different from your own, give both)

Full name ……………………………………………………………………………………….

Address ……………………………………………………………………………………………………

…………………………………………………………………………………………………………….

DOB (if Data Subject) ……………… Current or last school    ………………………………………

2.    Please describe your relationship with the Data Subject that leads you to make this request for information on their behalf. (i.e. Parent / Guardian)

…………………………………………………………………………………………………
…………………………………………………………………………………………………

3.   Please give details of the information you require to see. These may include for example:

  • a copy of all personal data held
  • a copy of all other data associated with the relevant Unique Pupil Number(s) or other learner numbers between 1/1/00 and 1/3/17
  • the details of its source
  • the reasons why the DfE is holding it
  • who the DfE has disclosed it to in the past
  • to know if the information has been used in any automated decision making

Declaration

I ………………………………………………………………..confirm that the information provided to the Department for Education (DfE) is true. I understand that it is necessary for the DfE to confirm the data subject’s identity and it may be necessary to obtain more detailed information in order to find the correct information. I further understand that the DfE must respond to this request within 40 days of its receipt. This period only begins once the DfE is satisfied that this application is correct.

Signed …………………………………………………. Date …………………………………