GDPR subject access requests and your child's school account — a parent's guide

The most common confusion parents have when their child's school account closes: "Can I just GDPR them and get the data back?"

The short answer is no — but for reasons that take a paragraph to unpack. This post is the unpack.

What a SAR actually gets you

UK GDPR gives data subjects the right to a Subject Access Request (SAR). For a child under 13, the parent typically exercises this right on behalf of the child; for older children, the child usually does it themselves (or with parental support).

A SAR gets you:

• A copy of the personal data the school holds about your child — admission records, attendance, behaviour records, pastoral notes, communications about the child between staff, official assessments, safeguarding records (with exemptions).
• Information about how the school uses that data, who it's shared with, and how long it's kept.
• Confirmation of the legal basis the school relies on for holding the data.

The right has been around in some form since 1998 (under the original Data Protection Act). It was strengthened by GDPR in 2018. It's free to exercise, and the school has one calendar month to respond.

What a SAR doesn't get you

The crucial distinction: SAR is about records about your child, not work by your child.

Your child's essays, OneNote notebooks, presentations, coursework, and any other content they produced in their school M365 account aren't typically "personal data the school holds about them" in the SAR sense. They're work the student produced inside an account the school provided.

When the account is deactivated and the data is deleted, a SAR doesn't recover it. The information about your child (their records) survives. The work by your child (their content) doesn't.

This isn't a UK quirk — it's broadly consistent across GDPR, FERPA (US), PIPEDA (Canada), the Privacy Act (Australia) and similar regimes globally.

The procedural details

If you want to make a SAR for your under-13 child:

1. Find the school's Data Protection Officer (DPO). Usually listed on the school's privacy policy page.
2. Write to the DPO. State that you're making a Subject Access Request under UK GDPR on behalf of your child. Include your child's full name, date of birth, year group.
3. Be specific about what you want. "All records you hold about [child]" is valid; "everything you have" is harder for the school to respond to in 30 days.
4. The school must respond within one calendar month. They may extend by up to two further months for complex requests but must tell you they're extending.
5. If you're not satisfied with the response, complain to the Information Commissioner's Office (ICO).

What's a different process entirely

Curriculum work retrieval — getting copies of your child's actual essays, OneNote notebooks, presentations — is a different process:

1. While the account is active, your child signs in and downloads. A tool like mydocs.school makes this a one-click action; the manual paths work for free if your school doesn't subscribe.
2. After the account is deactivated, contact the school's IT team directly. They may be able to restore within the soft-delete window (typically 30 days).
3. After hard delete, the data is gone. This isn't a school policy decision; it's a Microsoft architectural constraint.

Asking for curriculum work via the formal SAR route doesn't speed this up and may delay it — the DPO may need to escalate the request to IT, who then often respond that the data is unavailable.

What about exam evidence?

For exam appeals or re-marks, what you specifically need is often:

• The exam board's mark scheme application (held by the exam board, not the school).
• The original submission file (held by the school if it was uploaded to the exam board; otherwise on the student's M365 account).
• Evidence of internal verification (held by the school's exam office).

A SAR may help with the third item. For the first, you contact the exam board. For the second, the data follows the M365 account closure rules — if you can get it from the student's account while still active, do; otherwise the exam board has the submitted version.

What about teachers' annotations on coursework?

This is a partial yes. Teachers' annotations on a student's work are, arguably, personal data about the student (in the form of professional opinions about their performance). A SAR may surface these — but only if the school retained them, which often means only if they were on shared platforms like a SharePoint class site rather than only in the student's individual OneNote.

The cleanest way to preserve teacher annotations is the same as preserving the student's own work: download while the account is active. mydocs.school covers OneNote class notebooks, where teacher annotations on student work most commonly live.

What schools should and shouldn't do

A school responding to a parent SAR:

• Should: provide the requested personal data within 30 days, in a clear format, with explanations of any redactions.
• Should: explain what's excluded and why (e.g. third-party data, exempt information).
• Should not: charge a fee for the SAR (free unless the request is "manifestly unfounded or excessive", which is a high bar).
• Should not: require the parent to specify which records they want in advance (a general SAR is valid).
• Should not: refuse to disclose on grounds of inconvenience.

If a school does any of the "should nots", the appropriate escalation is the ICO.

The practical recommendation

For most parents reading this in advance: don't rely on the SAR route for retrieving your child's school work. The SAR isn't designed for it; even where it might in theory cover some annotations, it's slower, more bureaucratic and more uncertain than just downloading the work while the account is active.

For most parents reading this after the fact: a SAR may surface helpful records about your child, but it won't recover deleted M365 content. If you need the content specifically, contact the school's IT team within the soft-delete window; after hard delete, the content is genuinely gone.

For all parents: the leaver email from the school should mention the M365 closure timeline and the export options. If it doesn't, that's worth raising with the school — proactively communicating the closure window is the cheapest way to avoid both parental SAR escalations and student data loss.

What schools should do

If you're a school IT or data protection officer reading this: the most cost-effective intervention is the leaver communication. A single email at T-30 days clearly stating what closes, when, and how to download saves substantially on subsequent SAR misuse and reputation risk.

Specific recommendations:

• Send the email at T-30, then again at T-7.
• Be specific about dates. "Approximately end of summer" is not specific.
• Provide a self-service export tool. The conversion from "available tool" to "leavers actually export" is much higher than from "available knowledge".
• Document the policy. See the school-leaver offboarding policy template for a starter.

Parents responding to a clear, well-communicated leaver process rarely SAR the school. Parents responding to surprise data loss frequently do.

Bottom line

• SAR = records about your child. Use it for institutional records.
• M365 download = work by your child. Use it for curriculum content.
• Do the M365 download while the account is active. Don't wait.
• Save in two places. Cheapest insurance you'll ever pay for.