By Jonny Wathen | TransforMATive

The latest Tes article by Cerys Turner highlights a growing challenge for multi-academy trusts: the increasing volume, complexity and cost of responding to Subject Access Requests (SARs).

The figures are significant. Outwood Grange Academies Trust reports spending approximately £100,000 a year managing requests, while Wellspring Academy Trust describes how a single SAR can involve up to ten members of staff.

These demands place considerable pressure on already stretched education resources.

Importantly, trusts such as Wellspring have invested over several years in developing dedicated information governance capacity, organisational expertise, training and technology. Their experience demonstrates that even trusts with established arrangements are facing increasing pressures.

Others are at different stages of this journey, often managing complex information governance responsibilities alongside competing operational priorities.

For me, the response requires more than additional capacity. It demands a wider conversation about the maturity of information governance across the sector, the effectiveness of existing processes, the role technology can play and the support trusts should reasonably expect from government and regulators.

The challenge is not whether individuals should have access to their personal information. That right is fundamental. The question is how we deliver it effectively, proportionately and sustainably.

1. Effective information governance is built over time

Information governance is sometimes viewed primarily as a compliance function, with responsibilities delegated to a Data Protection Officer or another designated colleague.

In reality, effective information governance requires much more than an individual with specialist knowledge.

It depends on clear accountability, effective policies, established processes, appropriate systems and an organisational culture in which people understand their responsibilities.

Trusts with mature information governance arrangements have typically invested considerable time and resources in establishing these foundations. Other organisations may still be developing the capacity, skills and systems required to achieve the same level of consistency.

Neither position removes the increasing demands associated with SARs, but organisational maturity can make a significant difference to how effectively those demands are managed.

A mature information governance function does more than respond to requests. It equips the organisation to manage information consistently, proportionately and effectively.

One important observation from the Tes article is that some schools may be undertaking considerably more work than the law requires.

This is a wider sector concern, rather than a judgement on any individual trust. It highlights the importance of understanding both the obligations imposed by legislation and the practical boundaries of those obligations.

Knowing what an organisation is required to do and what it is not required to do, is an essential part of effective governance.

2. Responding to SARs requires a whole-organisation approach

A complex SAR rarely sits neatly within one department or professional discipline.

Information may be held across safeguarding systems, management information systems, HR records, emails, shared drives, pastoral records and other platforms.

Responding appropriately can, therefore, require coordinated input from school leaders, safeguarding professionals, HR teams, IT colleagues, administrators and information governance specialists.

Even the most experienced Data Protection Officer cannot manage this effectively in isolation.

Staff need appropriate training to understand how to identify relevant information, recognise sensitive personal data, preserve records, undertake proportionate searches and escalate decisions requiring specialist judgement.

There must also be clarity about who coordinates the response, who undertakes searches, who reviews information and who ultimately authorises disclosure.

The capability of the organisation is just as important as the expertise of the individual responsible for compliance.

This is why investment in training, shared understanding and established workflows should be viewed as essential organisational development rather than simply an additional compliance cost.

3. The public cost requires a coordinated response

Perhaps one of the most important considerations is the financial impact of responding to increasing volumes of SARs.

When an academy trust spends tens or even hundreds of thousands of pounds managing requests, that represents public money and staff capacity that cannot simultaneously be directed towards teaching, pastoral support or wider educational provision.

Of course, meeting statutory information rights is itself a legitimate and necessary use of public resources. The concern is the extent to which inefficient processes, uncertainty and avoidable administrative work increase that cost.

I would encourage both the Department for Education (DfE) and the Information Commissioner’s Office (ICO) to consider these wider implications when developing guidance, policy and expectations for the sector.

The ICO already provides guidance on reasonable and proportionate searches, clarification and the circumstances in which requests may be considered excessive or manifestly unfounded.

However, the experiences highlighted by Tes suggest that translating this guidance into consistent operational practice remains challenging.

School trusts need practical, education-specific examples addressing the complexity of SEND and safeguarding records, multiple information systems, large volumes of correspondence, third-party information and requests that span several years.

There is also a need for greater clarity about how organisations should respond to repeated requests and the specific circumstances in which the legal thresholds for refusal may be met.

The right of access must be protected, but trusts should not be left to interpret complex operational questions independently, potentially duplicating effort and incurring unnecessary cost.

Clearer guidance, practical resources and greater consistency could make a meaningful difference to the public cost of compliance.

4. Prevention should be part of the strategy

Much of the current conversation focuses on how schools can respond to SARs more efficiently.

That is important, but I think we should also consider how better information management could reduce the amount of unnecessary work involved before a request is ever received.

Data minimisation and effective retention practices are particularly relevant.

Most trusts have published retention schedules, but how consistently are these being implemented across every school, department and information system?

Are records being appropriately reviewed and deleted in accordance with established policies and legal requirements? Is unnecessary legacy information accumulating in shared drives, email accounts and disconnected systems?

The more information an organisation retains unnecessarily, the greater the potential burden when it must identify, search and review records. There is also a direct correlation with the growing cyber threats also experienced across the sector and beyond.

Importantly, this is about proactive, lawful information management, not deleting information in response to an existing request or circumventing disclosure obligations.

EdTech suppliers also have an important responsibility here.

Schools should not have to rely on manual workarounds to implement basic retention and deletion policies. MIS providers and other technology vendors should make it easier for trusts to apply retention schedules, manage access permissions and maintain appropriate information throughout its lifecycle.

Some suppliers have already begun improving these capabilities, but I would argue that effective information lifecycle management should increasingly become an expected feature of education technology.

5. Make appropriate information available by default

Another opportunity is to consider whether individuals need to make formal requests to obtain information that could reasonably be made available through existing channels.

Parents, carers and learners increasingly interact with schools through secure portals, apps and other digital platforms.

Could some of the information routinely requested through SARs be made available more easily through these systems?

For example, appropriate learner records, contact information and other routinely accessible information could be presented through secure platforms, subject to relevant legal rights, safeguarding considerations and access permissions.

Regular opportunities to review and correct information could also improve data quality and reduce misunderstandings.

This is not a substitute for the statutory right of access, nor should it create barriers to exercising that right.

However, making appropriate information readily available can reduce avoidable administration while improving transparency and strengthening relationships with families.

It is a relatively simple example of how better information management and purposeful digital design can benefit both the organisation and the individuals it serves.

6. Relationships, communication and clarification matter

We should also acknowledge that SARs are sometimes submitted alongside complaints, disputes or concerns about an individual’s experience of a school.

In these circumstances, the underlying issue may extend beyond the information being requested.

This makes the quality of communication and relationships particularly important.

Clear explanations, accessible information and constructive engagement can sometimes prevent misunderstandings from escalating.

The growing use of generative AI adds another dimension.

AI tools make it considerably easier to produce lengthy, detailed requests containing extensive references to legislation and broad demands for information.

That does not make a request invalid or imply that the individual has acted unreasonably. However, it can sometimes create a gap between the wording of a request and the information the person is actually seeking.

Where clarification is reasonably required, a constructive conversation may help identify the information sought and enable a more focused, effective response.

Such conversations must never be used to discourage legitimate requests or impose unnecessary barriers. They should be conducted within the applicable legal requirements and with respect for the individual’s rights.

There is a wider lesson here.

Good information governance is not solely about policies and processes. It is also about communication, transparency, trust and professional judgement.

7. Technology should reduce the burden without replacing professional judgement

Technology has an increasingly important role in supporting information governance, particularly where processes involve large volumes of repetitive administrative work.

Redaction is a clear example.

Anyone who has been involved in responding to a complex SAR will recognise the considerable time required to review documents, identify personal information, protect third-party identities and prepare records for disclosure.

These tasks are necessary, but elements of the work can be extremely resource-intensive when undertaken manually.

This is precisely the type of challenge we have been exploring at TransforMATive.

Our Eclipse platform has been designed specifically for education to support organisations with AI-assisted redaction.

Using machine learning and AI, Eclipse helps identify personal and potentially sensitive information, including contextual relationships that may require further review, allowing staff to complete redaction workflows more efficiently.

Importantly, Eclipse retains the human in the loop.

The technology supports the identification and redaction process, while authorised professionals retain responsibility for reviewing the information and deciding what should be disclosed, what should be protected and whether the final output is appropriate.

This distinction is essential when processing safeguarding information, sensitive educational records and personal information relating to children and families.

Eclipse is now used by more than 300 schools across England, reflecting growing interest in practical technologies that can reduce administrative workload while retaining appropriate professional oversight.

However, technology should not be viewed as a substitute for good governance, clear processes or trained colleagues.

The objective is to automate appropriate tasks, not automate accountability.

8. A sustainable response requires collective action

The increasing volume and complexity of SARs is not a challenge that individual schools and trusts should be expected to address entirely in isolation.

There are responsibilities across the education system.

• Trust leaders and governing boards should ensure that information governance arrangements are appropriately resourced, proportionate and regularly reviewed.
• Information governance professionals should be supported through training, consistent processes and access to specialist advice.
• The DfE and ICO should work together to provide clearer education-specific guidance and practical resources, recognising the operational and financial implications for schools.
• EdTech suppliers should help organisations manage information throughout its lifecycle, including access, retention, deletion and appropriate automation.
• The wider sector should share emerging practice, lessons learned and opportunities for greater consistency, rather than every trust independently developing solutions to the same problems.

For me, the strongest approach brings together governance, prevention, people, practice and technology.

Each has an important role, but none is sufficient in isolation.

A practical next step for trusts

For trusts currently experiencing increasing demand, I would encourage a review of the complete SAR process rather than simply adding more capacity to existing arrangements.

Some useful questions to consider include:

• Where are the greatest bottlenecks and administrative pressures?
• Do colleagues across the organisation understand their responsibilities?
• Are searches and reviews being conducted proportionately?
• Are published retention schedules being implemented in practice?
• Could appropriate information be made available more routinely?
• Are there opportunities to improve communication and clarification?
• Which repetitive activities could be supported more effectively through technology?
• Where would clearer guidance or specialist support make the greatest difference?

For those exploring AI-assisted redaction, Eclipse is available to trial free of charge, providing an opportunity to evaluate how technology could support existing information governance processes without making an immediate investment.

Explore Eclipse and start a free trial →

Ultimately, the objective should not be to make it more difficult for individuals to exercise their information rights, nor should it be to remove people from important decisions.

It should be to establish better processes, reduce unnecessary administrative work, protect sensitive information and ensure that valuable education resources are used as effectively as possible.

The increasing demand for SARs should prompt an important conversation about the expectations we place on schools, the resources available to meet those expectations and the opportunities to work more intelligently across the sector.

Good governance provides the foundations. Prevention reduces avoidable demand. Skilled people make the decisions. Technology helps make the process sustainable.

And as demand continues to grow, bringing these elements together has never been more important.

These same principles of accountability, purposeful innovation and human oversight are also central to Governing AI in school trusts, the guidance I recently co-authored with Samira Sadeghi for the Confederation of School Trusts (CST), in association with TransforMATive, which explores how trust leaders can govern AI responsibly while ensuring technology serves educational purpose and public benefit.