GDPR School Records Ireland: Using a Subject Access Request for SEN Advocacy

You've been attending meetings. You've asked for copies of documents. You've requested to see your child's School Support Plan. And you keep getting partial information, vague responses, or outright stonewalling.

There's a mechanism in Irish law that changes this dynamic completely. Under Article 15 of the GDPR, you have the right to request all personal data the school holds about your child — and they have one month to provide it, free of charge.

This is the Subject Access Request, and it's one of the most powerful tools available to SEN parents in Ireland.

What Is a Subject Access Request?

A Subject Access Request (SAR) is a formal mechanism under Article 15 of the General Data Protection Regulation (GDPR), as incorporated into Irish law through the Data Protection Act 2018. Any individual has the right to request a copy of the personal data held about them by any organisation — including a school.

For children under 16, parents or guardians can typically exercise this right on their behalf. You don't need to give a reason. You don't need the school's permission. You simply submit the request in writing to the school's data controller (in most schools, this is the Principal or the Board of Management), and they are legally required to respond within one calendar month.

They cannot charge you for the data. They cannot make the process unnecessarily complicated. The Data Protection Commission (DPC) in Ireland enforces these rights, and schools that refuse to comply or that delay unreasonably face regulatory action.

What Data Does a School Hold About Your Child?

This is where parents are often surprised by the breadth of what a SAR can reveal. An Irish school's data footprint on a SEN student typically includes:

The Student Support File (SSF): This is the central document. It should contain the School Support Plan(s) across all years, Classroom Support Plans, Basic Needs Checklists, Learning Environment Checklists, records of parental consultations, assessment reports submitted to the school, and the child's general educational profile.

Internal staff emails and communications: This includes emails between teachers discussing your child, communications between the principal and the SENO about resource applications, and any internal memos about the child's placement or behaviour.

Incident logs and behaviour records: Every documented incident involving your child, including any records that may have been used to justify a reduced timetable, a suspension request, or an SNA deployment decision.

External communications: Letters sent to or received from the NCSE, NEPS, HSE, Tusla, or other agencies about your child.

Minutes of meetings: If meetings about your child's support were minuted, those minutes are personal data.

Attendance records: Including any documentation related to shortened school days or requests for early collection.

The breadth of this data is significant. Many parents who submit a SAR discover that internal communications reveal a gap between what the school presented to them and what was actually being discussed or planned behind the scenes. They may find that NEPS or SENO recommendations were received but never actioned. They may find that the School Support Plan has not been updated in years, or that targets were never reviewed despite annual review requirements.

How to Submit a Subject Access Request to a School

The request must be in writing. There's no legally required form, but clarity is important. Your letter should:

1. Identify yourself and the child. Full name, date of birth, and current class.
2. Explicitly cite Article 15 of the GDPR. This signals that you know your rights and are making a formal data protection request, not an informal information query.
3. Specify the data you are requesting. A broad request for "all personal data held about [child's name]" is valid, but you can also be specific: "including all versions of the Student Support File, incident logs, internal correspondence referencing [child's name], records of assessments received, and communications with external agencies."
4. State the time period if relevant. "From September 2022 to present" is a reasonable scope for an ongoing SEN case.
5. Provide contact details for where you want the response delivered.

Send the letter by email with a read receipt, or by recorded post. Keep a copy.

The school must respond within one calendar month. If the data is particularly complex or voluminous, they can extend by a further two months, but they must notify you of this extension within the first month and give a reason. If they simply go quiet, that's a potential data protection breach you can report to the DPC.

How a SAR Supports Your SEN Advocacy Case

The strategic value of a SAR goes well beyond getting copies of documents. Used correctly, it serves several purposes:

It confirms what the school actually has on file. If the school tells you verbally that a SMART target has been set, or that the SSP was reviewed in October, the SAR reveals whether this is true. Discrepancies between verbal assurances and the written record are powerful evidence in a BOM complaint.

It reveals what instructions the school received and ignored. A SENO might have issued written guidance that the school never shared with you. NEPS reports might have made recommendations that were filed but never implemented. The SAR uncovers this paper trail.

It captures the school's internal assessment of your child. Internal emails can reveal attitudes and assumptions that shaped decisions about your child — information you never would have seen otherwise.

It creates a complete evidentiary record. If you need to escalate to the Ombudsman for Children, the Workplace Relations Commission, or legal proceedings, the SAR gives you access to the full factual record held by the school.

It signals seriousness. A formal GDPR request tells the school that you are approaching this methodically and that you are aware of your rights. Schools that have been stalling informal requests often move more quickly once a formal SAR arrives.

What Happens If the School Refuses or Delays?

If the school fails to respond within one calendar month, or provides an inadequate response, or refuses the request without a valid legal basis, you have the right to complain to the Data Protection Commission. Complaints to the DPC are free and can be submitted online at dataprotection.ie.

The DPC has the power to investigate, issue reprimands, require schools to provide the data, and impose sanctions. A referral to the DPC is a serious matter for a school and typically accelerates compliance.

A Note on What Schools Can Withhold

Under Article 23 of the GDPR and Schedule 2 of the Data Protection Act 2018, there are limited grounds on which a school can withhold or redact data — primarily where disclosure would identify another individual (such as a teacher or another student) or where it would cause serious harm. Schools sometimes use these exemptions incorrectly. If you believe data has been improperly withheld, include this in your DPC complaint.

The Ireland Special Ed Advocacy Playbook includes a model SAR letter tailored for schools, with the specific GDPR citation, suggested scope language, and guidance on what to do with the data once you receive it. Getting the letter right the first time avoids back-and-forth delays and ensures the school understands this is a formal legal request from day one.

A SAR won't by itself solve the problem — but it hands you the complete factual record that every other advocacy route depends on.

See more Ireland guides →