How Schools Should Handle Unclear Parental Requests, FOI Requests, Complaints and SARs
Schools and trusts are seeing more parental emails that read like legal submissions. Some quote FOI, UK GDPR, safeguarding duties, complaints policies and education law in the same paragraph. Some are drafted with AI. Many are long, formal and confident, even when the rights described do not quite fit the situation.
That does not mean the concern is invalid. A parent may use the wrong label but still make a valid request. The school’s job is to work out what the parent is really asking for, protect the pupil’s interests and follow the right legal or procedural route.
This guide is for general information only. It is not legal advice, and schools should seek specialist support on complex or high-risk cases.
Start with the substance, not the labels
A parent may write:
“Please provide all information under FOI and GDPR, explain why this decision was made, send my child’s complete file and investigate the unlawful disclosure of confidential information.”
That single message may contain several different things:
a subject access request
a request for a child’s educational record
a Freedom of Information request
a complaint
a safeguarding concern
a request for an explanation
an allegation of a data breach
The first step is not to argue with the wording. Read the message once for meaning. Ask: what practical outcome is the parent seeking?
Then record the date received and acknowledge the request. The acknowledgement should be calm, neutral and useful. It can say that the message appears to raise several matters and that the school will deal with each under the relevant process.
Do not force everything into one route because the parent used one legal phrase. A request headed “FOI” may contain a valid subject access request. A complaint may also include a request for recorded information. A SAR may include questions that need to be handled as a complaint.
One message can trigger more than one deadline.
Separate the strands before responding
A simple triage exercise will prevent most errors. Break the message into strands and assign each to the right owner or process.
What the parent is asking for | Likely route | Key point |
Copies of their own personal data | Subject access request | The requester has a right to their own personal data, subject to exemptions |
Copies of the child’s personal data | Child’s SAR, possibly made through a parent | The child’s capacity, wishes and best interests matter |
The child’s educational record | Parental educational record access, where it applies | This right applies in maintained schools in England and Wales, not academies |
Policies, procedures, spending records or other non-personal recorded information | Freedom of Information | FOI covers recorded information, not new explanations |
Why a decision was made or why staff acted in a certain way | Complaint or service response | A complaint process is usually the right forum |
Alleged disclosure, mishandling or loss of information | Data protection incident process and possibly complaint | Consider containment, investigation and notification duties |
Welfare or risk concerns | Safeguarding process | Safeguarding should not wait for information governance triage |
This does not need to be elaborate. A short internal note can be enough:
received on 8 September
contains SAR, complaint and possible FOI elements
safeguarding checked
educational record right considered
response leads allocated
deadlines diarised
That record may later matter if the parent complains to the regulator, the local authority, the trust or the Department for Education.
Know when a request is a subject access request
A subject access request, often called a SAR, is a request by an individual for their own personal data. It does not need to say “subject access request” or “UK GDPR”. If a parent writes, “Please send me all emails about me,” that is likely to be a SAR.
A SAR gives access to personal data, not every document in full. A document may contain the requester’s personal data, the child’s personal data, staff personal data and information about other pupils. The school must review the information before disclosure.
Common examples include:
emails mentioning the requester
behaviour logs containing the requester’s comments or actions
meeting notes that record the requester’s views
complaint correspondence involving the requester
call notes or contact records about the requester
The usual deadline for responding to a SAR is one calendar month. School holidays do not stop the clock. In some cases, the deadline can be extended, but schools should not rely on that without checking the rules and recording the reason.
If the request is unclear, ask for clarification where it is genuinely needed. For example, “all information about me and my child” may be too broad to search sensibly without more detail. Even then, keep the request moving. Do not use clarification as a way to delay a difficult response.
Treat the child’s information with particular care
Parents often assume they have an automatic right to all information about their child. That is not always correct.
A child has their own data protection rights. A parent may be able to act on the child’s behalf, but the school should consider whether that is appropriate. The key questions include:
Is the child mature enough to understand the request?
Has the child expressed a view?
Does the parent have authority to act?
Would disclosure be in the child’s best interests?
Are there safeguarding or welfare concerns?
Would disclosure reveal information about another person?
For younger children, it may often be reasonable for a parent to act on their behalf. For older pupils, especially where the information is sensitive, the position needs more care.
This is not about withholding information for the sake of it. It is about recognising that the pupil is a person with their own rights and interests.
A practical approach is to record the decision-making. For example:
the pupil’s age and understanding
whether the pupil was consulted
the nature of the information requested
any known family circumstances or court restrictions
any safeguarding input
the reason for disclosing, withholding or redacting information
If the school decides not to provide some information, explain the decision in a measured way. Avoid legalistic language where plain English will do.
Do not confuse a SAR with parental access to educational records
In maintained schools in England and Wales, parents have a separate statutory right to access their child’s educational record under the relevant national regulations. This is different from a SAR.
The educational record route normally concerns records that relate to the pupil’s academic and educational progress. The deadline is generally 15 school days.
This right does not apply to academies. Academy trusts still need to consider SARs and other duties, but the specific maintained-school educational record access right is different.
This distinction matters because parents may ask for “the school file” without knowing which right applies. A maintained school may need to consider both:
the parental right of access to the educational record
the child’s or parent’s rights under data protection law
Academies should avoid saying the maintained-school educational record rules apply to them. They should instead identify what has been requested and respond through the correct data protection or policy route.
Understand what FOI can and cannot do
Freedom of Information is about recorded information held by a public authority. Schools and academy trusts are public authorities for FOI purposes.
FOI can cover information such as:
policies and procedures
minutes, where held and disclosable
spending records
contracts, subject to exemptions
anonymised statistics, if already held
governance records
published schemes and reports
FOI is not a route to obtain someone else’s private information. It is not a way to force the school to create a new explanation, answer hypothetical questions or give an opinion that is not already recorded.
If a parent asks, “Why did the headteacher decide this?” FOI only applies if the school holds recorded information that answers the question, such as minutes, notes or correspondence. If no recorded information exists, FOI does not require the school to create it.
The normal FOI deadline for schools has a special rule. It is usually 20 school days, or 60 working days, whichever is sooner. If a request is unclear, the school may need to seek clarification and provide advice and assistance.
When personal data is caught by an FOI request, consider the personal information exemption. Do not disclose private information about pupils, parents or staff through FOI unless it is lawful and appropriate.
This is where unclear parental requests FOI complaints and SARs can overlap in a difficult way. A parent may ask under FOI for emails about a child, while also complaining about staff conduct. The correct response may be part FOI refusal or redirection, part SAR consideration and part complaint handling.
Keep complaints on the complaints route
A complaint asks the school to investigate dissatisfaction, make findings or put something right. That is different from FOI, which provides recorded information, and different from a SAR, which provides personal data.
A parent may write a long message containing legal references when the core concern is simple:
my child was treated unfairly
staff failed to follow policy
I was not told about an incident
the school shared information wrongly
the response to bullying was inadequate
reasonable adjustments were not made
Those issues need a complaint response, not just an information rights response.
The school should acknowledge the complaint under its complaints procedure, unless another statutory process applies. It should also explain which parts of the message are being handled separately.
For example:
“We will treat your concerns about the handling of the playground incident as a complaint under stage one of the school complaints procedure. Your request for copies of emails will be considered separately under data protection law.”
This helps avoid a common mistake: answering the complaint but ignoring the SAR, or responding to the SAR but failing to investigate the concern.
Use clarification carefully and fairly
When a message is unclear, schools can ask the parent to clarify what they want. This should be done promptly and helpfully.
Good clarification is specific. It might ask:
whether the parent wants information about a particular incident or date range
whether they are seeking their own data, the child’s data or general school information
which decision they want reviewed as a complaint
whether they want copies of documents or an explanation
whether they are acting on behalf of the child
Poor clarification sounds defensive or obstructive. Avoid replies such as:
“Your request is invalid.”
“You have quoted the wrong law.”
“We cannot respond unless you restate this properly.”
“Please confirm exactly which statutory regime you rely on.”
Parents do not need to use perfect legal wording. If the school can reasonably identify the request, it should deal with it.
This matters even more when the parent may be distressed, disabled, using translation tools or relying on AI to express a concern. A formal tone does not always mean the sender understands the law. A confusing email may still point to a serious issue.
Protect third-party information before disclosure
Information requests often involve other people. School records may include details about:
other pupils
siblings
parents or carers
staff members
external professionals
complainants or witnesses
Before disclosing information, review it for third-party personal data and confidential material. Redaction is often needed.
The school should take special care with:
safeguarding records
child protection concerns
special category data
health information
behaviour incidents involving several pupils
witness accounts
staff disciplinary or grievance matters
family court or custody issues
Redaction should be purposeful. Blank out what cannot lawfully be disclosed, but do not remove information just because it is awkward or critical of the school.
Keep a clean copy, a redacted copy and a note of the reasons for redactions. This creates an audit trail if the decision is challenged.
Watch for safeguarding and data breach issues
Some unclear requests contain warning signs that go beyond information access.
For example, a parent may allege that:
one parent has received information they should not have
a child’s address has been disclosed
a report was sent to the wrong person
staff discussed a pupil with another family
a separated parent is seeking information despite known risk concerns
a child is frightened about information being shared
These points should be flagged to the safeguarding lead and information governance lead quickly. Do not wait until the SAR or FOI deadline is near.
If there may have been a personal data breach, the school should assess it under its data breach process. That may involve containment, risk assessment, notification and communication with affected people. Not every error is reportable to the Information Commissioner’s Office, but the assessment should be recorded.
If there is any concern about harm to a child, safeguarding comes first.
Give one coordinated response where possible
Even where different routes apply, the parent should not receive contradictory replies from different parts of the school.
A coordinated response does not always mean one single letter. It means the school has joined up the handling.
Before sending replies, check:
all strands of the original message have been logged
each deadline is clear
safeguarding has been considered
the child’s rights and wishes have been considered where needed
exemptions and redactions have been reviewed
the complaint response does not disclose information that the SAR or FOI response withholds
staff named in the request have been treated fairly
the tone is consistent
A simple holding reply can also help:
“Your email raises several issues. We are treating your request for recorded information under FOI, your request for personal data under data protection law and your concerns about the incident as a complaint. These processes have different timeframes, and we will update you if we need clarification.”
This reassures the parent that the email has been understood, while giving the school space to manage each route correctly.
Keep the tone calm when the wording is formal or wrong
AI-drafted messages can sound more certain than they are. A parent may cite the wrong legislation, demand an impossible deadline or threaten escalation.
Do not mirror the tone. A calm response protects the school and often reduces conflict.
Use wording such as:
“We have considered the substance of your request.”
“We will handle this part of your email as a subject access request.”
“FOI provides access to recorded information. It does not require the school to create a new explanation.”
“Some information may need to be withheld or redacted where it relates to other individuals.”
“We will deal with your concerns about the decision through the complaints procedure.”
Avoid point-scoring. The aim is not to prove the parent wrong. The aim is to respond lawfully, fairly and clearly.
Use a simple checklist for every mixed request
A short checklist can reduce mistakes:
Acknowledge receipt
Record the date and confirm that the message has been received.
Identify each strand
Separate SAR, FOI, educational record, complaint, safeguarding and breach issues.
Check the requester’s status
Confirm who is asking, who the information concerns and whether authority is needed.
Consider the child’s rights
Look at age, understanding, wishes, best interests and safeguarding concerns.
Diarise each deadline
SAR, FOI, educational record access and complaints may all run differently.
Clarify only where needed
Ask focused questions if the request cannot be understood or searched.
Search proportionately
Look in the places where relevant information is likely to be held.
Review before disclosure
Check third-party data, exemptions, confidentiality and safeguarding risks.
Respond in plain English
Explain what has been provided, withheld or handled under another route.
10. Keep an audit trail
Save the request, notes, searches, decisions, redactions and response.
The best response starts with careful triage
Unclear parental requests are rarely solved by treating the parent’s wording as the final answer. The safer approach is to read for substance, separate the strands and apply the right route to each one.
A single email can be a SAR, an FOI request, a request for an educational record and a complaint at the same time. It may also raise safeguarding or data breach concerns.
Schools that handle these messages well do three things consistently: they log deadlines early, they protect the pupil’s interests and they explain the process in plain English. That gives parents a fair response and gives the school a defensible record of what it did.
Comments