Part one: what changed
Your search must be reasonable and proportionate
Section 78 of the Act inserts a new paragraph 1A into Article 15 of the UK GDPR:
“the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search”
— Data (Use and Access) Act 2025, s.78(1)
This was already established in case law. The change is that it now sits in the statute, which makes it a great deal easier to point at. It has been there since the Act was passed on 19 June 2025, and Parliament backdated it to 1 January 2024 — so it applies to requests that were already in progress then.
The ICO’s guidance sets out what it means in practice:
“You must make a reasonable and proportionate search to respond to a SAR. This means that you must make reasonable efforts to find and retrieve the requested information. However, you are not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to the information.”
— ICO, Right of access: how do we find and retrieve the relevant information?
When judging whether a search would be unreasonable, the ICO says you should weigh four things: the circumstances of the request; the volume of information you may need to search; any difficulties in finding it; and the fundamental nature of the right of access. That last one is there to stop proportionality becoming a general excuse, and it sets the bar deliberately high.
The sentence to take away
“You must be able to show why a search is unreasonable or disproportionate.”
— ICO, Right of access: how do we find and retrieve the relevant information?
Note the word must. The ICO distinguishes carefully between must — a legal requirement — and should, which is expected good practice. Weighing the four considerations is a should. Being able to show your reasoning is a must.
For most schools this is not a documentation problem so much as a timing one. The reasoning almost always exists: someone decided which systems to search, how far back to go, whether to include the safeguarding file, and had good reasons. It just lives in the head of whoever did it, and it leaves when they do. Writing the scope decision down at the time costs minutes. Reconstructing it convincingly a year later is close to impossible.
And narrowing a search is not abandoning one:
“Even where searching for certain information may be unreasonable or disproportionate, you should still search for any other information within the scope of a request.”
— ICO, Right of access: how do we find and retrieve the relevant information?
You can stop the clock while you wait for clarification
Section 76 inserts a new Article 12A into the UK GDPR, headed “Meaning of ‘applicable time period’”. Where you have asked a requester for the information you need to identify what they are actually asking for, the period between your request and their reply does not count towards the response deadline.
The one-month period itself has not changed. What changed is how it runs — and note the mechanism is an exclusion, not a suspension: those days simply do not count. Article 12A has been in force since 5 February 2026.
Two cautions. The request for clarification has to be genuine — this is not a way of buying time by asking a question you do not need answered. And you will want a record of when you asked and when they replied, for the same reason you want a record of the scope decision.
Automated decision-making
Section 80 replaces Article 22 of the UK GDPR outright, from 5 February 2026, with four new Articles — 22A (automated processing and significant decisions), 22B (restrictions), 22C (safeguards) and 22D (further provision). The regime moves from a prohibition with narrow exceptions to a permissive framework with required safeguards.
For most schools this changes nothing day to day. Nothing in it obliges you to automate anything. But if you meet “Article 22” in your privacy notices, your DPIAs or a supplier’s documentation, that is now the replaced provision and is worth a check.
The ICO’s detailed guidance on automated decision-making is still in draft at the time of writing: a draft went out to consultation on 31 March 2026, and the final version had not appeared by late October 2026.
Part two: the exemptions that catch schools out
None of this changed in 2025. It is here because it is where school SARs actually get difficult, and because it is more school-specific than most general guidance admits.
Information about other people
This is the big one, and it is not a blanket rule. Schedule 2, Part 3 of the Data Protection Act 2018 says you are not obliged to disclose information that would identify another individual — but that you must do so where either that person consents, or “it is reasonable to disclose the information to the data subject without the consent”.
So there is a test, and it runs in both directions. In deciding what is reasonable you must consider:
- the type of information;
- any duty of confidentiality owed to the other person;
- steps taken to seek their consent;
- whether they are capable of giving consent;
- any express refusal.
The practical consequence is the one most often missed: over-redaction is a failure too. A teacher named in a pupil record, writing in their professional capacity, is not in the same position as a family member disclosing something personal — the type of information and the duty of confidentiality differ, and the test may well make disclosure reasonable. Redacting every name that is not the requester’s is easier, and it is not what the law asks for.
Educational records: the serious harm test
Schedule 3, Part 4 restricts access to education data — information forming part of an educational record, other than health data — where disclosure would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
Worth reading that twice: the person the exemption protects may be the requester themselves. This is not only about protecting third parties from the person asking.
Where a parent asks on a child’s behalf
Schedule 3, Part 5 deals with child abuse data — information about whether someone is, has been, or may be at risk of child abuse. Where a parent or guardian makes the request on behalf of a child under 18, disclosure is restricted where it would not be in the best interests of the data subject.
Two things schools get wrong here. It is not a general exemption for safeguarding material — it turns on who is making the request and on whose behalf. And it does not apply in Scotland.
References, exam scripts and legal advice
Also in Schedule 2, Part 4, and all three come up in schools:
- Confidential references — given or received, with an education-specific provision.
- Exam scripts and marks, which have their own restrictions.
- Legal professional privilege, where the school has taken advice.
What this adds up to
Almost everything above is a judgement — whether a search went far enough, whether disclosure is reasonable without consent, whether it would cause serious harm, whether it is in a child’s best interests. None of it can be decided by a rule applied mechanically, and none of it can be decided by software. It is decided by a person who knows the child, the file and the context.
What the law now asks, more explicitly than it did, is that the person can show their reasoning afterwards. That is the change worth acting on this term: not searching differently, but writing down why you searched as you did, and why you withheld what you withheld, at the moment you decide it.