Subject access requests for school counselling notes — a step-by-step guide

By the CounselNote team · Last reviewed 25 September 2026

This guide is general information, not legal advice. In a school, SARs should always be handled with the data protection officer (DPO).

What a subject access request is

Article 15 of UK GDPR gives individuals the right to obtain a copy of their personal data, along with information about how it is used. A request does not have to be in writing, use any particular wording, or mention the law. "Can I see what the counsellor has written about my son?" can be a valid SAR.

Counselling notes that identify a pupil are that pupil's personal data. That includes informal or personal notes if they identify the pupil and are held by or on behalf of the school.

Who can make the request

The right of access belongs to the pupil, not the parent. A parent can make a request on the child's behalf, but the school needs to consider whether the child is mature enough to understand their rights.

• In Scotland, the Data Protection Act 2018 (section 208) presumes that a child aged 12 or over is of sufficient age and maturity to exercise their data protection rights, unless the contrary is shown.
• In England, Wales and Northern Ireland there is no fixed age — it depends on the individual child's understanding.

The ICO's guidance for schools is clear that it is the pupil's right to make a SAR: a parent can only make a request for their child's information if the child is not competent to act for themselves, or has given their consent. If the child is competent, respond to the child directly, or check that the child has authorised the parent to act on their behalf. Consider the child's best interests and any safeguarding implications of disclosing information to a parent.

The deadlines

• You must respond without undue delay and within one calendar month of receiving the request.
• You can extend by up to two further months if the request is complex or you have received several requests from the same person — but you must tell the requester within the first month and explain why.
• You usually cannot charge a fee, unless the request is manifestly unfounded or excessive.
• The clock can be paused while you verify the requester's identity or ask them to clarify a very broad request.

School holidays do not stop the clock, so schools should have a plan for requests received during breaks.

Exemptions that often matter in counselling

You must provide everything the person is entitled to, but some information may be withheld. The most relevant in a counselling context are:

• Third-party information. Notes often mention other people — parents, friends, siblings. You do not have to disclose information that identifies another person unless they consent or it is reasonable to disclose without consent. Redaction is the usual solution.
• Serious harm. The Data Protection Act 2018 contains exemptions where disclosing certain health, social work or education data would be likely to cause serious harm to the physical or mental health of the data subject or another person. Applying these exemptions may require an opinion from an appropriate professional.
• Child abuse data. Where a parent requests a child's data, information about child abuse can be withheld to the extent that disclosure would not be in the child's best interests.
• Crime and legal proceedings. Information may be withheld if disclosure would prejudice the prevention or detection of crime.

Exemptions must be applied case by case, and only to the parts of the record they cover. Keep a note of what you withheld and why.

Step by step

1. Recognise and log the request, with the date received.
2. Tell your DPO straight away.
3. Verify identity and authority — is the requester the pupil or authorised to act for them? Is the pupil competent?
4. Search everywhere — electronic notes, paper files, email, backups, supervision notes that identify the pupil.
5. Review each record — identify third-party data and consider exemptions, taking advice where needed.
6. Redact carefully and check the redaction cannot be reversed (for digital documents, use proper redaction tools rather than drawing black boxes).
7. Respond within the deadline, explaining the purposes of processing, retention period and the right to complain to the ICO.
8. Keep a record of what you disclosed and the reasons for any withholding.

Educational records are a separate right

In maintained schools in England, parents also have a separate right to access their child's educational record under the Education (Pupil Information) (England) Regulations 2005, which must be answered within 15 school days. Whether counselling notes form part of the educational record depends on how they are held and who created them — ask your DPO.

Why good note-writing makes SARs easier

If your notes are factual, proportionate, and clearly separate observation from opinion (see our guide on writing session notes), disclosing them is far less stressful. Notes written on the assumption that the pupil or a parent might read them rarely need extensive redaction.

How CounselNote helps

CounselNote keeps each pupil's records in one encrypted place on one computer, so you can find everything held about a pupil quickly when a request comes in. See the guide or try it free for 30 days.

Official sources

• Information Commissioner's Office, A guide to subject access
• Information Commissioner's Office, Right of access: education information
• Data Protection Act 2018, section 208 — children in Scotland
• Data Protection Act 2018, Schedule 3 — exemptions for health, social work, education and child abuse data
• The Education (Pupil Information) (England) Regulations 2005, SI 2005/1437

This guide is general information for school counsellors and pastoral staff in the UK. It is not legal advice. Always follow your school's safeguarding, data protection and records policies, and take advice from your DSL, DPO or supervisor on individual cases.