Introduction
Signed declarations allow you to request records on somebody's behalf. These are often called 'forms of authority', and obtaining one is a necessary first step to making a request for personal information.
Subject access request
Data controllers will not release personal information to you unless you can prove you have the permission of the data subject. In school exclusions, the data subject will be the young person. However, in some circumstances, the person with parental responsibility makes the request on behalf of the child.
You will need to get written permission from the right person to request records on the young person's behalf. This written permission is often called their 'authority', and the document is often called a 'form of authority'.
Because there's no bright-line cutoff age to tell you whether you will need the young person's authority or the parent's authority, it will usually be appropriate to get both. This will mean you can provide both authorities to the data controller, who will not be able to delay the process by requesting further authorities.
Freedom of Information
You do not need any permission to make a freedom of information ('FOI') request, as these requests are for information that the public has a right to anyway.
Downloads
- To write to the young person or parent with more information about making an SAR, consider using the Suggested Wording document: Making a subject access request
- To provide the young person with an authority to give you permission to request records on their behalf, consider using using the Template document: Form of authority (young person)
- To provide the parent with an authority to sign to give you permission to request records on the young person's behalf, consider using using the Template document: Form of authority (parent)
Next step?
Once you have obtained the relevant Forms of Authority, continue to the next step.
