GDPR

Subject Access Request

Bolton Impact Trust and its academies will follow current data protection and other legislative guidance when dealing with Data Subject Access Requests (Click here for current ICO Pupils Info). 

As a Multi Academy Trust, a student or parent (person with parental responsibility/Legal guardian) does not have a legal right to access a child’s educational record. 

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them. This includes:

• Confirmation that their personal data is being processed
• Access to a copy of the data
• The purposes of the data processing
• The categories of personal data concerned
• Who the data has been, or will be, shared with
• How long the data will be stored for, or if this isn’t possible, the criteria used to determine this period
• The source of the data, if not the individual
• Whether any automated decision-making is being applied to their data, and what the significance and consequences of this might be for the individual

Making a subject access request

It is preferred that Subject Assess request are made in writing either by letter or email to the DPO, Gill Smith or Director of Academy Operations Rebecca Leonard using the request form available on our website. They should include:

• Name of individual
• Correspondence address
• Contact number and email address
• Details of the information requested

If staff receive a subject access request they must immediately forward it to the DPO.

Please complete the SUBJECT ACCESS REQUEST FORM and send it to Mrs Gill Smith (DPO) or Miss Rebecca Leonard (Director of Academy Operations Bolton Impact Trust). Any request in writing from the individual (Data Subject) will be considered as a valid request, whatever the format as long as it contains the relevant information to enable us to deal with your request.

Children and subject access requests.

Personal data about a child belongs to that child, and not the child's parents or carers. For a parent or carer to make a subject access request with respect to their child, the child must either be unable to understand their rights and the implications of a subject access request, or have given their consent.

Children below the age of 12 are generally not regarded to be mature enough to understand their rights and the implications of a Subject Access Request. Therefore, most Subject Access Requests from parents or carers of pupils at our Trust who are below the age of 12 may be granted without the express permission of the pupil. This is not a rule and a pupil’s ability to understand their rights will always be judged on a case-by-case basis.

Children aged 12 and above are generally regarded to be mature enough to understand their rights and the implications of a Subject Access Request. Therefore, most Subject Access Requests from parents or carers of pupils at our Trust who are aged 12 years or older may not be granted without expression permission of the pupil. This is not a rule and a pupil’s ability to understand their rights will always be judged on a case-by-case basis. All decisions will be logged by the DPO.

Responding to a Subject Access Request

When responding to requests, we: 

• May ask the individual to provide 2 forms of identification
• May contact the individual via phone to confirm the request was made 
• Will respond without delay and within 1 month of receipt of the request
• Will provide the information free of charge
• May tell the individual we will comply within 3 months of receipt of the request, where a request is complex or numerous. We will inform the individual of this within 1 month, and explain why the extension is necessary.

We will not disclose information if it:

• Contains personal data on another data subject
• Conflicts with an ongoing legal case
• Might cause serious harm to the physical or mental health of the pupil or another individual
• Would reveal that the child is at risk of abuse, where the disclosure of that information would not be in the child’s best interests
• Is contained in adoption or parental order records 
• Is given to a court in proceedings concerning the child.

If the request is unfounded or excessive, we may refuse to act on it, or charge a reasonable fee which takes into account administrative costs. A request will be deemed to be unfounded or excessive if it is repetitive, or asks for further copies of the same information. When we refuse a request, we will tell the individual why, and tell them they have the right to complain to the ICO.

How do you provide your identity?

If you are not known to the Trust Academy or Trust office, we may ask to see proof of your identity. The following forms of identity will be accepted as proof of identity:

· A copy of your passport

· A copy of your driving licence

· A copy of your Bank, building society or credit card statement in the Data Subject's name for the last quarter

· A copy of your Council Tax bill

Will you be charged for information provided?

We will follow guidance within current Data Protection legislation in relation to charges for information. See www.ico.org.uk for further information.

Photo Consent Forms