External Individual SAR
Run a request for someone outside your organisation - a parent, customer or former member.
Use this route when the person whose data is being requested is not a current member of your organisation. Typical examples are a parent, a customer, or someone who has since left.
Choose based on the individual the request is about, not who submitted it. A parent requesting their child's records is a request about the child - and if the child is a current student, that is an Internal individual request.
Before you start
- You must be logged in to a DPO account
- The system you want to search must be connected
- You need the requester's details and the individual's details
Step by step
Click New SAR
Then choose Create a SAR, then External individual.
Enter the requester's details
The name and email address of the person making the request.
Confirm who the request is about
Indicate whether the requester is also the individual. If not, provide the individual's details separately.
Add supporting context
Record anything relevant - for example that a parent has provided consent to request a child's information.
Add keywords
Names, phrases or identifiers that should guide the search and stay unredacted.
Confirm verification
Confirm identity checks have been completed.
Set a password and proceed
Create the archive password, review the summary, and start the request.
Requests made on behalf of someone else
Where a parent or representative is requesting on behalf of another person, record that you have the necessary permission in the additional information field. That note forms part of the request's audit trail.
What happens next
Track it in SAR Monitoring. When redaction completes, review and release it - see Reviewing & Delivering.