We see this a lot. A member of staff has been the subject of a referral from their Local Authority Designated Officer (LADO). The investigation has run its course. And then a subject access request (SAR) lands – forwarded to the data protection lead with a note that says, essentially, "what do we do with this?".

The instinct in many schools is to hold back as much as possible. We understand it. LADO investigations are sensitive. The information is serious. But resistance without a proper legal basis isn't a safe option.

This article sets out what your school needs to know: what the right of access actually covers in a LADO investigation context, which exemptions can genuinely be relied upon, and what happens when the investigation is closed but a disciplinary or grievance process is still running.

What does the right of subject access actually cover?

A SAR gives a requester the right to confirmation of whether their personal data is being processed, a copy of that personal data, and certain supplementary information – including why it's being used and where it came from.

The right is to their own personal data, not to every document in the LADO file.

That's an important starting point, and one that helps. You aren't being asked to hand over the entire file.

You're being asked to identify the requester's personal data across all relevant records – which may include referral documentation, correspondence with the LADO, strategy meeting minutes, investigation records and HR files – and to provide it, subject to any exemptions that apply.

Key exemptions: Why prejudice matters

Schools often start from a position that because information relates to a safeguarding investigation, it can be withheld. That's not how exemptions work.

Prejudice to an identified, live purpose is the key concept in the exemptions that matter most here. There are two primary exemptions to consider.

The crime and investigation exemption

Schedule 2, Part 1, Paragraph 2 of the Data Protection Act 2018 (DPA 2018) disapplies the right of access where complying with the SAR would be likely to prejudice the prevention, investigation or detection of crime, or the apprehension or prosecution of offenders.

Both limbs must be satisfied: the data must be processed for one of those specific purposes, and disclosure must be likely to cause real, substantial prejudice to that purpose.

Genuine prejudice looks like alerting a suspect that they are under investigation before they have been interviewed, compromising or enabling the destruction of evidence, exposing a confidential source, or undermining a parallel police investigation.

It doesn't look like "this information came from a safeguarding investigation, so it's exempt." The connection to an investigation isn't the test. The prejudice is. If disclosure of a particular document wouldn't damage the investigation, that document should be provided.

The functions designed to protect the public exemption

Schedule 2, Part 1, Paragraph 7 DPA 2018 is, in our experience, the exemption that receives less attention than it deserves in a LADO context. It restricts the right of access where complying would be likely to prejudice the discharge of specified public-protection functions.

These include protecting the public against dishonesty, malpractice, seriously improper conduct, or the unfitness or incompetence of persons in regulated roles.

The LADO's function falls within this public-protection function. The LADO exists to oversee and co-ordinate the management of allegations against adults who work with children.

Where that process is live, disclosure of specific information that would compromise it may properly attract this exemption. Examples include the identity of a confidential referrer, material that would allow the subject to anticipate evidence, or information shared by another agency on the understanding it would not be immediately disclosed.

It's, again, not a blanket safeguarding exemption. You need to be able to identify:

• The specific public-protection function being exercised.
• The specific information you are considering withholding.
• Why disclosing that information is likely to prejudice the function's proper discharge.

"The LADO is involved" isn't enough. "Disclosing this document would reveal the identity of the person who made the referral, who hasn't consented to identification and whose willingness to cooperate with safeguarding processes would be jeopardised" – that's the kind of reasoning that supports the exemption.

As with the crime exemption, information that can be disclosed without prejudicing the function must still be provided.

Third-party data exemption

LADO files almost always contain information about other people – child complainants, witnesses, referrers, colleagues, social workers.

Information about another living, identifiable person may be withheld where disclosure would reveal their third-party personal data, they haven't consented to the disclosure and it wouldn't be reasonable to disclose their information without consent.

Redaction should be considered as a way to balance the requester’s right of access against the third party’s right to privacy. The fact that a document contains information about a third party does not mean the whole document is withheld, it means the third-party passages may need to be redacted.

However, there will be circumstances where even redacted copies of information may still reveal information that has been shared in confidence. That context will usually support withholding the document in its entirety.

Marking a document 'confidential' isn't, by itself, legally conclusive. But a genuine duty of confidence that can be identified and articulated will carry real weight.

What about information relating to professionals?

Information relating to professionals acting in their official capacities – including LADO officers, HR investigators and safeguarding leads – will usually be provided unredacted, as it's reasonable for the information to be disclosed. The balance is different for staff acting in their professional capacity than it is for a child or a witness.

When the LADO investigation has closed

Once the LADO has concluded its process, both primary exemptions become difficult to sustain. The statutory test in each case requires likely prejudice to a live purpose.

The information may have been generated in the course of a LADO investigation, but that doesn't make it permanently exempt.

The right question after closure isn't "was this information generated in the course of an investigation?" It's "what current prejudice would disclosure cause?” If there's no ongoing criminal investigation, no active regulatory process, no continuing LADO function to protect, and the honest answer to that question is "none" – then the exemptions aren't available.

What the right of access covers after closure

The right of access after closure will typically extend to:

• the referral documentation submitted to the LADO;
• correspondence between the school and the LADO;
• strategy meeting minutes, insofar as they contain the requester's personal data;
• investigation records; and
• the outcome and any employment decisions that followed.

Third-party passages may still be redacted. Legal advice may still be protected. But the file doesn't remain permanently off limits to the individual involved because it relates to sensitive subject matter.

When the LADO investigation has closed but the HR process continues

Now let’s consider what happens once the LADO investigation has concluded. The school has started a disciplinary investigation or formal hearing. A SAR arrives.

The school wants to resist disclosure because it's worried about the impact on the HR process. We understand the worry, but this doesn't mean that the information can be withheld.

The crime and investigation exemption won't ordinarily help. An HR disciplinary or grievance investigation isn't the detection of crime or the apprehension of offenders. Unless there's a live parallel police investigation, this exemption doesn't apply to the internal HR proceedings themselves.

The public protection and regulatory functions exemption requires careful thought. If the disciplinary process is running alongside a referral to the Teaching Regulation Agency or a DBS referral, there may be an argument that paragraph 7 has a role to play in relation to those regulatory proceedings specifically. It's worth taking advice on that.

Stretching paragraph 7 to cover a school's own internal HR investigation is a different matter. The exemption was designed with statutory regulators and enforcement bodies in mind. It's a technical argument that can be explored with legal advice; it isn't a straightforward answer.

Why fair procedure matters

So where does that leave your school?

By the time a member of staff is in a formal disciplinary process, they need to understand the case against them. That's a fundamental requirement of a fair procedure.

It isn't just good practice, but a requirement that goes to the lawfulness of the process and the defensibility of any outcome. If the disciplinary case rests on LADO findings and investigation material, the member of staff needs to see the substance of that material in order to respond to it.

Summary

Schools receive SARs in this context and feel, often quite viscerally, that the information should be protected. Sometimes it should be. But "this came from a LADO investigation" isn't, on its own, the answer.

The exemptions require specific prejudice to a live purpose. Once the LADO has closed and no connected process is running, that test becomes very hard to meet.

You should document every decision relating to the SAR; what you are withholding, which exemption you are relying on, and what prejudice you have identified. If your reasoning would not withstand scrutiny from the ICO, revisit it.

If you're dealing with a SAR in this kind of situation, or trying to work out how your LADO obligations, your HR process and your data protection duties fit together, please do get in touch. These situations are rarely straightforward in practice, but they're manageable with the right advice early.

Further support and resources

Our data protection support pack for schools and trusts contains detailed guidance on handling subject access requests. 

With our data protection CPD programmes, we’ll help you develop the skills and confidence needed to handle data protection effectively. Our other support packs equip you with the resources to do it efficiently.