UK disclosure terms, in plain English

The requests

Subject access request (SAR)

A request from an individual to see the personal data an organisation holds about them, made under Article 15 of the UK GDPR. Anyone can make one, in any form, without giving a reason.

Freedom of Information (FOI) request

A request for recorded information held by a public authority. Unlike a SAR, an FOI request is about information generally, not about the requester — and anyone may make one.

Environmental Information Request (EIR)

A request for environmental information held by a public authority. Runs in parallel to FOI with a broader definition of what counts as held information and its own exceptions.

Disclosure

The material an organisation actually sends out in response to a request — after searching, deciding what is in scope, and redacting what must not be released. The word covers both the act and the bundle.

The law

UK GDPR

The General Data Protection Regulation as it applies in UK law, operating alongside the Data Protection Act 2018. It sets the rules for processing personal data and contains the right of access that a SAR exercises. Both have since been amended by the Data (Use and Access) Act 2025.

Data Protection Act 2018 (DPA 2018)

The UK statute that supplements the UK GDPR — setting out exemptions, special-category conditions, and the regulator’s powers. In practice a SAR is answered against both documents together, not either alone.

Freedom of Information Act 2000 (FOIA)

The statute creating the general right of access to information held by public authorities in England, Wales and Northern Ireland, and by UK-wide bodies — together with the exemptions that limit it. Scottish devolved public authorities come under the Freedom of Information (Scotland) Act 2002 instead, which has its own exemptions and its own regulator.

Article 15

The provision of the UK GDPR that gives a person the right to obtain a copy of their personal data. It is the legal basis a subject access request runs on.

The people

Data subject

The person a piece of personal data is about. In a SAR, the data subject is usually the requester — though records about them frequently contain other people’s data too, which is where redaction starts.

Data controller

The organisation that decides why and how personal data is processed, and carries the accountability for it. A school, GP practice or housing association answering a SAR is acting as controller.

Data processor

An organisation that processes personal data on a controller’s instructions. SureMatters is not a processor of your documents — they never reach us; SureRedact and SurePrepare run on your own computer.

Data Protection Officer (DPO)

The person responsible for advising an organisation on data-protection obligations and monitoring compliance. Required for public authorities and some others; widely appointed voluntarily. Often the person who ends up carrying the SAR caseload.

Information governance (IG) officer

The role — common in the NHS, local authorities and larger trusts — responsible for how records are handled, retained and disclosed. Frequently the person who has to sign off that a disclosure is safe to send.

The work

Redaction

Removing information from a document before it is disclosed, so that what remains can be shared safely. In a SAR that usually means third-party personal data, and material covered by an exemption.

Forensic redaction

Redaction where the underlying content is destroyed, not covered. A black rectangle drawn over text in an annotation layer can often be deleted, moved, or copied out from underneath. Forensic redaction removes the content itself, so what is gone is actually gone. This is how SureRedact works by default, not a setting to find.

Exemption

A provision in law allowing an organisation to withhold information it would otherwise have to disclose — for example where releasing it would reveal another person’s personal data, or prejudice a legal claim. Exemptions must be applied deliberately and be justifiable afterwards.

Third-party personal data

Information about someone other than the requester, appearing in records the requester has asked for. The most common reason to redact in a SAR, and the judgement that takes the most time: whether the other person can be identified, and whether disclosing anyway is reasonable.

Scope

The decision about which records fall inside a request and which do not — date ranges, systems searched, people included. Scope is where most of the real work in a disclosure happens, and the part most often left unwritten.

Disclosure pack

The bundle sent out at the end: the redacted documents, plus the record of what was done to them. A SureRedact Professional disclosure pack contains the redacted files, a manifest listing every file with a hash, the sealed decisions log, and a redaction certificate — so a recipient can check it rather than take your word for it.

Audit trail / decisions log

The record of who decided what, and when. In SureRedact every operator action is written to an append-only log, sealed at export so that any later change to a past entry is detectable.

School sector terms (England)

These terms are the ones used in England. Education is devolved, so Scotland, Wales and Northern Ireland use their own vocabulary and legislation for much of this ground — for example, what England calls SEND is Additional Support Needs in Scotland and Additional Learning Needs in Wales. If you work outside England, treat these entries as orientation rather than as your own framework.

Safeguarding

The duty to protect children and vulnerable adults from harm, and the work an organisation does to meet it. Safeguarding records turn up constantly in school and care-sector disclosure work, and they are usually the most sensitive material in a request — both for the person who asked and for the third parties named in them.

Designated Safeguarding Lead (DSL)

The named person in a school responsible for safeguarding — who records concerns, decides on referrals, and holds the files. In a subject access request the DSL is often the person who knows what exists and where, which makes them a necessary voice in scoping even when they are not the one answering the request.

SEND (Special Educational Needs and Disabilities)

The framework covering support for pupils with additional needs. SEND records are detailed, long-running, and involve multiple professionals — so a SAR touching them usually returns more material, from more sources, than the requester expects.