When your team is staring at thousands of pages of emails and pupil records, software can feel like a quick fix.

Used well, technology takes a huge amount of heavy lifting out of Subject Access Requests (SARs) – but we need to remember where the software’s job ends and human judgement begins.

Across the education sector, the volume and complexity of SARs continue to rise. For school business leaders, Data Protection Officers (DPOs) and trust central teams, the burden of locating, reviewing and redacting documents within statutory timescales is a real pressure.

It's understandable that many schools and multi-academy trusts are turning to automated redaction software to manage the workload.

What can redaction software do for schools?

Good redaction software is brilliant at the mechanical heavy lifting. It can search across multiple mailboxes, de-duplicate sprawling email chains so you only review the final thread once and apply secure redactions that can't be lifted after disclosure.

The challenge comes when software is marketed, or relied upon, as a tool that can make the legal decisions for you.

The risks of automated redaction in school SARs

Many technology providers promise their tools will automatically find and redact all third-party personal data in seconds. But when schools rely on automated rules to black out every third-party name without human oversight, the result is often more risk and more work than it saves.

We regularly review SAR bundles where automated rules have redacted documents to the point of being nonsensical. In some cases, tools have redacted the requester’s own personal data, or blacked out text on emails that the requester wrote and sent to the school.

Sending a parent or staff member a sea of black boxes over an email they sent breeds suspicion, escalates the underlying grievance and drives complaints to the Information Commissioner's Office (ICO).

Third-party redaction is a balancing test, not a blanket rule

Almost every school record contains mixed personal data. A behaviour log mentions several pupils. An email chain includes another parent’s perspective. An HR investigation file records witness statements from colleagues.

The rules governing how to handle other people’s personal data in a SAR sit in Paragraph 16 of Schedule 2 of the Data Protection Act 2018 (DPA 2018).

Paragraph 16 doesn't impose a blanket ban on releasing third-party names. Instead, it sets out a practical balancing test. You don't have to disclose information that identifies another individual (including identifying them as the source of the information), unless either:

1. The other individual has consented to the disclosure.
2. It is reasonable to disclose the information to the requester without that individual's consent.

To decide whether it's reasonable to disclose without consent, the legislation requires the reviewer to weigh up the context, including:

• The type of information that would be disclosed.
• Any duty of confidentiality owed to the other individual.
• Any steps taken by the school or trust to seek the individual's consent.
• Whether the other individual is capable of giving consent.
• Any express refusal of consent by the other individual.

Context is everything. If the requester already knows the identity of the third party – because they were in the same meeting or copied into the email chain – it's far more likely to be reasonable to leave that information unredacted.

Pupil and parent SARs: How Paragraph 17 guides the decision

One of the most common myths in school data protection is that staff must redact the names of every teacher, teaching assistant and other staff member from a pupil’s SAR bundle.

Paragraph 17 of Schedule 2 of the DPA 2018 helps organisations carry out the Paragraph 16 balancing test when records contain the personal data of health, social care and education workers.

When a parent or pupil makes a SAR, Paragraph 17 makes clear that it's generally reasonable to disclose information relating to an education worker, health professional or social work professional without their consent, provided the information relates to them in their official capacity.

In day-to-day school life, this means:

• Routine professional input stays in: If a teacher logs a behaviour incident, a SENCO writes a support update or a social worker contributes a report to a pupil record, their name and professional opinions should normally remain visible.
• Private staff data comes out: If an email chain mentions why a teacher is off sick, their personal phone number or an internal HR matter, that's their private personal data and should be redacted.
• Serious harm remains the exception: If disclosing a staff member's name or statement is likely to cause serious harm to the physical or mental health of any person (for example, where there's a genuine threat of violence or intimidation), that information can be withheld under the serious harm exemptions in the DPA 2018.

Staff and HR SARs: A different contextual balance

When a member of staff submits a SAR (often alongside a grievance or disciplinary process), Paragraph 17 doesn't apply to the employment records. You return to the Paragraph 16 balancing test, and the factors look quite different.

In an HR context, relying on automated redaction alone is risky because the reasonableness of disclosing a colleague's name often turns on seniority, role and expectation:

Seniority and management responsibility: If a headteacher, line manager or HR lead writes an email about an employee’s performance or conduct as part of their normal management role, the employee would reasonably expect to see their manager’s name attached to those comments. Redacting it rarely makes sense.

Junior colleagues and confidential witnesses: If a junior member of staff raises an informal concern or provides a witness statement about a more senior colleague in confidence, they carry a much stronger expectation of privacy. Here, the balancing test is far more likely to favour redacting their name and any identifying details.

Combining redaction software with human judgement

Software has a role to play in modern information governance. If a tool can save your team 20 hours of manual searching, de-duplicating, formatting and applying redactions, that's time well spent.

But software can't know the history of a family complaint. It doesn't know who was in the room during a pastoral meeting, and it can't weigh up the difference between a headteacher writing a routine appraisal note and a junior teaching assistant raising a sensitive concern.

The best protection against SAR burnout isn't expecting software to do the legal thinking. It's combining practical technology with a well-trained team who understand how Paragraphs 16 and 17 work, and giving them the confidence to make proportionate, common-sense decisions.

How we can help

Our education data team works alongside schools, academies and multi-academy trusts to make Subject Access Requests practical and proportionate. We also offer bespoke SAR consultancy sessions designed to help you build a solid, sustainable SAR strategy. Whether you need hands-on support with a complex request, advice on getting the best from your systems or ongoing coaching for your DPO through our Empower DPO service, please get in touch.