UK disclosure terms, in plain English

The requests

Subject access request (SAR)

A request from an individual to see the personal data an organisation holds about them, made under Article 15 of the UK GDPR. Anyone can make one, in any form, without giving a reason. The organisation must respond within one month, extendable by up to two further months where the request is complex or numerous. The clock can be paused while you seek clarification from the requester about what they are actually asking for; once you have what you need, it resumes.

Freedom of Information (FOI) request

A request for recorded information held by a public authority. Unlike a SAR, an FOI request is about information generally, not about the requester — and anyone may make one. Which Act applies depends where the authority sits: the Freedom of Information Act 2000 covers England, Wales, Northern Ireland and UK-wide bodies, while Scottish devolved public authorities — including Scottish schools and councils — come under the Freedom of Information (Scotland) Act 2002, regulated by the Scottish Information Commissioner rather than the UK regulator. Sources: Freedom of Information Act 2000 · Freedom of Information (Scotland) Act 2002

Environmental Information Request (EIR)

A request for environmental information held by a public authority. Runs in parallel to FOI with a broader definition of what counts as held information and its own exceptions. The same jurisdictional split applies: the Environmental Information Regulations 2004 for England, Wales, Northern Ireland and UK-wide bodies; the Environmental Information (Scotland) Regulations 2004 for Scottish devolved authorities. Sources: Environmental Information Regulations 2004 · Environmental Information (Scotland) Regulations 2004

Disclosure

The material an organisation actually sends out in response to a request — after searching, deciding what is in scope, and redacting what must not be released. The word covers both the act and the bundle.

The law

UK GDPR

The General Data Protection Regulation as it applies in UK law, operating alongside the Data Protection Act 2018. It sets the rules for processing personal data and contains the right of access that a SAR exercises. Both have since been amended by the Data (Use and Access) Act 2025.

Data Protection Act 2018 (DPA 2018)

The UK statute that supplements the UK GDPR — setting out exemptions, special-category conditions, and the regulator’s powers. In practice a SAR is answered against both documents together, not either alone.

Data (Use and Access) Act 2025 (DUAA)

An Act that amends the UK GDPR, the Data Protection Act 2018 and PECR rather than replacing them. It commenced in phases between June 2025 and June 2026. For disclosure work the material changes are that the search obligation is codified as “reasonable and proportionate”, that the response clock can be paused while an organisation seeks clarification from the requester, that Article 22 on automated decision-making is replaced by new Articles 22A–22D, and that the ICO’s structure changes. Both subject-access changes codify what was already ICO guidance, putting it on a statutory footing rather than creating new mechanisms — which is why they should feel familiar rather than new. Sources: ICO — what the DUAA means for organisations · gov.uk — DUAA factsheets

Freedom of Information Act 2000 (FOIA)

The statute creating the general right of access to information held by public authorities in England, Wales and Northern Ireland, and by UK-wide bodies — together with the exemptions that limit it. Scottish devolved public authorities come under the Freedom of Information (Scotland) Act 2002 instead, which has its own exemptions and its own regulator.

Article 15

The provision of the UK GDPR that gives a person the right to obtain a copy of their personal data. It is the legal basis a subject access request runs on.

Article 22 (and Articles 22A–22D)

Article 22 of the UK GDPR was the provision governing decisions made about a person by automated processing alone. The Data (Use and Access) Act 2025 replaced it — along with section 14 of the Data Protection Act 2018 — with new Articles 22A–22D. The change is structural: from a prohibition with narrow exceptions to a permissive framework with required safeguards. Under it you must be told about significant decisions made about you, be able to make representations and challenge them, and be able to obtain human intervention. You will still meet “Article 22” in older guidance, privacy notices and DPIAs: it is the provision that was replaced, not the one now in force. Where SureRedact sits: the operator confirms or rejects every redaction, so the decision is never made by the software alone — a deliberate design choice rather than a response to what the law requires. Source: DUAA 2025 factsheet — UK GDPR and DPA

Information Commission

The UK’s data-protection regulator. The Information Commissioner’s Office was structured as a corporation sole, with all powers vested in one individual; the Data (Use and Access) Act 2025 replaces it with the Information Commission, a body corporate led by a chair, chief executive, and other non-executive and executive members with shared decision-making responsibilities. Existing functions continue — the governance model is what changes. “ICO” remains correct in everyday use, because the chair of the Information Commission retains the title Information Commissioner; name the Information Commission in formal citations and procurement documents. It handles complaints about how organisations answer subject access requests, among much else. Source: DUAA 2025 factsheet — ICO

The people

Data subject

The person a piece of personal data is about. In a SAR, the data subject is usually the requester — though records about them frequently contain other people’s data too, which is where redaction starts.

Data controller

The organisation that decides why and how personal data is processed, and carries the accountability for it. A school, GP practice or housing association answering a SAR is acting as controller.

Data processor

An organisation that processes personal data on a controller’s instructions. SureMatters is not a processor of your documents — they never reach us; SureRedact and SurePrepare run on your own computer.

Data Protection Officer (DPO)

The person responsible for advising an organisation on data-protection obligations and monitoring compliance. Required for public authorities and some others; widely appointed voluntarily. Often the person who ends up carrying the SAR caseload.

Information governance (IG) officer

The role — common in health bodies, local authorities and larger trusts — responsible for how records are handled, retained and disclosed. Frequently the person who has to sign off that a disclosure is safe to send.

The work

Redaction

Removing information from a document before it is disclosed, so that what remains can be shared safely. In a SAR that usually means third-party personal data, and material covered by an exemption.

Forensic redaction

Redaction where the underlying content is destroyed, not covered. A black rectangle drawn over text in an annotation layer can often be deleted, moved, or copied out from underneath. Forensic redaction removes the content itself, so what is gone is actually gone. This is how SureRedact works by default, not a setting to find.

Exemption

A provision in law allowing an organisation to withhold information it would otherwise have to disclose — for example where releasing it would reveal another person’s personal data, or prejudice a legal claim. Exemptions must be applied deliberately and be justifiable afterwards.

Third-party personal data

Information about someone other than the requester, appearing in records the requester has asked for. The most common reason to redact in a SAR, and the judgement that takes the most time: whether the other person can be identified, and whether disclosing anyway is reasonable.

Proportionate search

The standard for how hard an organisation must look when answering a request. The Data (Use and Access) Act 2025 codifies existing case law on reasonable and proportionate searches, putting on the statute a threshold the courts had already established. In practice it means you are not required to search everywhere at any cost — but you are expected to be able to explain where you searched and why you stopped. Source: ICO — right of access

Stop the clock

Pausing the response deadline while an organisation seeks clarification from a requester. The Data (Use and Access) Act 2025 lets a controller pause the response time — without the risk of missing the deadline — if they need the data subject to clarify or refine their request, or to provide more information; once the organisation has what it needs, the response time continues. The one-month period itself is unchanged: what changed is how it runs. Source: ICO — right of access

Scope

The decision about which records fall inside a request and which do not — date ranges, systems searched, people included. Scope is where most of the real work in a disclosure happens, and the part most often left unwritten.

Disclosure pack

The bundle sent out at the end: the redacted documents, plus the record of what was done to them. A SureRedact Professional disclosure pack contains the redacted files, a manifest listing every file with a hash, the sealed decisions log, and a redaction certificate — so a recipient can check it rather than take your word for it.

Audit trail / decisions log

The record of who decided what, and when. In SureRedact every operator action is written to an append-only log, sealed at export so that any later change to a past entry is detectable.

School sector terms (England)

These terms are the ones used in England. Education is devolved, so Scotland, Wales and Northern Ireland use their own vocabulary and legislation for much of this ground — for example, what England calls SEND is Additional Support Needs in Scotland and Additional Learning Needs in Wales. If you work outside England, treat these entries as orientation rather than as your own framework.

Safeguarding

The duty to protect children and vulnerable adults from harm, and the work an organisation does to meet it. Unlike the other terms in this section, this one is not England-specific: the duty is recognised across all four UK nations, though each has its own legislation and guidance. Safeguarding records turn up constantly in school and care-sector disclosure work, and they are often the most sensitive material in a request — both for the person who asked and for the third parties named in them.

Designated Safeguarding Lead (DSL)

In England, the named person in a school responsible for safeguarding — who records concerns, decides on referrals, and holds the files. In a subject access request this is often the person who knows what exists and where, which makes them a necessary voice in scoping even when they are not the one answering the request. (The role exists across the UK under different titles.)

SEND (Special Educational Needs and Disabilities)

In England, the framework covering support for pupils who need more than the standard offer. Records of this kind are detailed, long-running, and involve multiple professionals — so a SAR touching them usually returns more material, from more sources, than the requester expects. (Scotland and Wales use different frameworks and vocabulary.)