City of York Logo

Top of page

Size: View this website with small text View this website with medium text View this website with large text View this website with high visibility

2.3 Access to Records


This chapter should be in conjunction with the Confidentiality Policy.

See also Access to Birth Records and Adoption Case Records Procedure.


Children Act 1989 Guidance and Regulations Volume 3: Planning Transition to Adulthood for Care Leavers (revised January 2015)

Information Commissioners Office - Guide to Data Protection


In December 2016 this guidance was reviewed and updated as required. Section 7, Application by Parents has been rewritten.


  1. Rights of Access
  2. Exceptions
  3. Offering an Informal Approach
  4. Handling Formal Requests for Access – a Step-by-Step Guide
  5. Timescales
  6. Applications by Children
  7. Applications by Parents
  8. Applications by Care Leavers
  9. Applications by Agent
  10. Application on Behalf of Deceased Persons
  11. Correction or Erasure of Records
  12. Refusal of Access
  13. Appeals Process

    Appendix 1: Confidentiality and Access to Records Leaflet

1. Rights of Access

The provisions for access to personal information or records held by Children's Social Care are contained in the Data Protection Act 1998. Under this legislation, those in respect of whom personal information is held in any form have a right of access to the information, unless one of the exceptions set out below applies.

The Data Protection Act applies to both paper and manual records and records held electronically. It is important that electronic recording systems comply with the requirements for children and their families to easily find their story in a logical narrative.

The Freedom of Information Act 2000 gives people the right to see all types of other non-personal information held by children's services. Local authorities should publicise their access to records policy with clear information about how care leavers and others can apply for their records and access support services.

2. Exceptions

Exceptions to the right to access are:

  1. Where the practice of social work would otherwise be prejudiced because access to the information would be likely to result in serious harm to the person requesting the information or some other person;
  2. Where the person is incapable of managing his or her affairs (for example where the person is a child) with sufficient age and understanding and the information was given in the expectation that it would not be disclosed or is information which the subject of the information expressly indicated should not be disclosed;
  3. Adoption Case Records - see Access to Birth Records and Adoption Case Records Procedure.

Also access can be refused if:

  • To disclose the information would involve disclosure of information about someone else without that person’s consent and disclosure cannot be justified without that person’s consent; or
  • Where disclosure may prevent the detection or investigation of a crime.

Access can also be refused if an identical or similar request has been received from the same person and already been complied with, unless a reasonable interval has elapsed.

These exceptions do not permit the total withholding of information but only those sections of the material covered by the exceptions. The remainder of the case records should be made available to the service user.

The exceptions do not apply where disclosure is required by a court order or is necessary for the purpose of or in connection with any legal proceedings.

In addition, a Court may prevent disclosure of information where a person shows that he or she would be caused serious harm to his physical or mental health by the disclosure.

3. Offering an Informal Approach

The practice of all staff should be to encourage ongoing and open sharing of information and recording, including providing copies of key documents. It is expected that practitioners will share a written record of assessments and review reports with the subject of the report, at the time of writing (subject to age and understanding). See Recording Standards Procedure.

If a person in receipt of services asks to see a particular document or wants to have information about a particular aspect of the case, the social worker should discuss this with them to see whether the request can be dealt with informally by showing them the relevant part of the file or providing copies of relevant documents.

4. Handling Formal Requests for Access – a Step-by-Step Guide

Step 1: Corporate Customer Complaints and Feedback Team confirm Subject Access Request

Any request by an applicant for Subject Access, even if they do not use the precise term, whether verbal or written should be notified to the Corporate Customer Complaints and Feedback Team who are responsible for the logging of all such requests.

The Corporate Customer Complaints and Feedback Team will check the validity of the Applicant’s Subject Access Request, ascertaining whether they are able to satisfactorily identify themselves as the subject of the data requested, or a parent of the subject of the data requested.

In the case of parent applicants, the Corporate Customer Complaints and Feedback Team will check whether the parent is entitled to the information or whether the child is competent to understand their rights to their own information (it is the child’s information and not the parent’s, even though the parent may have parental responsibility). A child over the age of twelve years old is presumed to be competent and able to authorise the Subject Access Request by a parent of their information, a parent of a child under twelve years of age is presumed to be acting in the best interests of the child unless their is information to the contrary.

Where the Corporate Customer Complaints and Feedback Team confirm that the request is a legitimate Subject Access Request, they will notify the Referral and Assessment Service Business Support ( and they will log and track the request to completion using a unique identifier.

The 40 days timescale for completion of a Subject Access Request from confirmation of receipt of a legitimate request is calendar days and not working days.

Step 2: Referral and Assessment Service Business Support confirm whether data on the Subject is held

Referral and Assessment Business Support will check whether there are any records about the subject held by Children’s Services which can be identified. Where none are identified, Business Support will contact the Corporate Customer Complaints and Feedback Team and advise them. The Corporate Customer Complaints and Feedback Team will then contact the Applicant directly to advise them. The Subject Access Request is then ended and no further action is required.

Where the Applicant is requesting information about a subject for whom there are records held by Children’s Services, Business Support will contact either the Service Manager responsible for a qualified Social Worker allocated to the subject or the Duty Service Manager within the Referral and Assessment Service who will assume responsibility to manage the Subject Access Request. 

Step 3: Service Manager Allocation of Subject Access Request 

The Service Manager must allocate the Subject Access Request within 24 hours of contact from Business Support notifying them that there is a Subject Access Request requiring completion.

If the data subject has an allocated qualified Social Worker at the point of the Request, ordinarily it will be for the allocated Social Worker to complete the Subject Access Request as an additional task as part of ongoing casework.

Where the data subject is not open to a Qualified Social Worker, including children and young people open to the Child in Need Service or the Pathway Team, it will be for the Qualified Social Work staff within the Service area to undertake the Subject Access Request on behalf of their non-Social Work qualified colleague.

It is for the Service Manager to make sure that the allocated Social Worker understands the task and is familiar with the Guidance and Process for Subject Access Requests. Progress of the task should be subject to ongoing case management Supervision for the duration that the task is open to ensure no drift and delay against statutory timescales.

Irrespective of capacity issues and casework prioritisation, the Information Commissioners Office advises that the 40 day period is considered the ‘right balance’ between resource constraints and the right of an individual to the prompt access to their personal data. Accordingly, no Subject Access Request should exceed this timescale. If the Service Manager is concerned that the 40 day timescale may be exceeded, the Service Manager must notify the Head of Service.

Step 4: Allocated Social Worker Contacts the Applicant to Clarify Data Requested

Within 3 days of allocation, the Social Worker should make telephone contact with the applicant to clarify what information the applicant particularly wants or what question they are seeking to answer. Whilst the applicant is entitled to all information held (subject to Data Protection requirements), it is often the case that the applicant is interested in records relating to a particular decision, incident or process. By focusing the Subject Access Request in this way, this may result in a reduction in the amount of documentation required and speed up the disclosure to the applicant.

Following the telephone call, the Social Worker allocated the Subject Access Request should then send a letter to the Applicant advising of disclosure date, the information it was agreed will be provided and their contact details so that the Applicant has a point of contact to track the Subject Access Request being undertaken on their behalf.

Step 5: Allocated Social Worker requests records relevant to Subject Access Request from Business Support

Within a maximum of 3 days from allocation, the Social Worker will contact Business Support for their Service Area to locate, retrieve and prepare all records relevant to the Subject Access Request.

Step 6: Business Support prepares Unredacted PDF within 14 days

Business Support will provide the allocated Social Worker with a single unredacted PDF of all records relevant to the Subject Access Request within 14 days of the request from the allocated Social Worker.

Should Business Support be unable to prepare an unredacted PDF within the 14 day timescale, it is the responsibility of the allocated Business Support Officer to raise this issue with their Business Support Manager. The Business Support Manager has overall management for the preparation of an unredacted PDF of the Subject Access Request and may seek additional resources to ensure that the timescale is met.

A copy of the unredacted PDF will be saved to the Document Management System by Business Support.

Step 7: Allocated Social Worker Decides What can be Disclosed

Within 14 days of receipt of the Unredacted PDF, the allocated Social Worker for the Subject Access Request must review the document and use professional judgement to apply the statutory legislation and guidance relating to what should and should not be disclosed to the Applicant.

Decisions should be based on Guidance such as that issued by the Information Commissioners Office: Information Commissioner's Office

In practice, the usual reasons for redaction, though not limited to, will be:

  • Third party information without consent to disclose;
  • Legal privilege;
  • Medical Information;
  • Exempted information (this is where the disclosure of information is deemed to cause serious harm).

Once the document has been reviewed, any information which should not be disclosed needs to be redacted.

Should the allocated Social Worker be unable to complete a review of the unredacted PDF within the 14 day timescale, it is the responsibility of the Social Worker to raise this issue with their Service Manager. The Service Manager has overall management responsibility for the completion of the Subject Access Request and may seek additional resources to ensure that the timescale is met.

Step 8: Allocated Social Worker/Business Support Redacts PDF for Disclosure

The PDF must be redacted in preparation for disclosure within a maximum of 5 days from completion of the decisions about what can and cannot be disclosed. The Social Worker can do this themselves using redaction software available on several desktop computers at West Offices on the First Floor. Please note however that not all Council desktop computers currently support the use of this software.

The Social Worker may also request the support of Business Support to undertake the redaction. The request should be made to the Business Support Manager to allocate and prioritise this task.

A copy of the redacted PDF will be saved to the Document Management System.

Step 9: Allocated Social Worker arranges with Applicant how they want to receive the data to be disclosed under the Subject Access Request

Concurrent to the redaction activity, the allocated Social Worker for the Subject Access Request must contact the applicant to arrange with the applicant how they want to receive the data. Given that records disclosed by Children’s Social Care may contain information of circumstances that may cause distress, it is good practice for the allocated Social Worker to offer to meet with the applicant to support them when providing them with the disclosure. Where the disclosure is of a large number of records, the allocated Social Worker should clarify with the Applicant whether they would wish to be contacted at a later date to ensure that the Applicant is supported following a disclosure. It is noted that accessing personal data can have a profound impact on an Applicant and they may need signposting to support services.

The Applicant should also be made aware of why any information has been redacted and of their right to complain to the Council and also to the Information Commissioner should they have any concern about the way their Subject Access Request was responded to. The Information Commissioner’s contacts are:

Information Commissioner's Office
Wycliffe House
Water Lane

Step 10: Allocated Social Worker Notifies that Subject Access Request has been completed.

Once the disclosure has been made, the Subject Access Request is completed. The Allocated Social Worker should contact the Corporate Customer Complaints and Feedback Team who will log the completion of the Subject Access Request.

A record should be made on the Case Management System against the subject of the data.

Both the electronic version of the unredacted and the redacted documents for the Subject Access Request will be subject to the normal file retention and destruction criteria for the subject child’s case file.

5. Timescales

Access must be given to disclosable information within 40 days of receiving the request. This is the maximum time period allowed. The timescale can only be extended with the agreement of the person requesting access. Where he or she refuses to agree an extension, access should be given to all information open to disclosure at that point.

6. Application by Children

Requests from children should be treated in the same way as requests from adults. A judgement should be made by the social worker as to whether the child making the request for access understands the nature of the request. Where appropriate, a parent should be asked to provide written confirmation that the child understands the nature of the application.

Children with disabilities have the same rights as others to have access to information held about them. No assumption should be made about their level of understanding. This should be assessed on an individual basis as with all children.

A child of sufficient understanding should be allowed regular access to information held about him or her, consistent with his or her best interests. He or she should read or be told what has been recorded unless it falls within one of the exceptions set out above.

A child should be encouraged to record his or her own observations on the case record including when there is disagreement about an entry in the file.

In Scotland the law presumes that a child ages over 12 has the capacity to make a subject access request. The presumption does not apply in England and Wales but does suggest an approach that will be reasonable in many cases.

7. Application by Parents

Even if a child is unable to understand the implications of a request, data held about them is still their personal data and does not belong to anyone else, even a parent. It is the child who has the right of access to information held about them; this is true even in the case of young children whose rights are likely to be exercised for them by people with parental responsibility.

Before responding to a request from a parent for access to information held about a child, it should be considered whether the child is mature enough to understand their rights. If they are they should be responded to rather than the parent. If a worker is unsure about whether a child is able to understand what it means to make a request and how to interpret the information they receive as a result the worker should consider the following:

  • The child's level of maturity and ability to make decisions like this;
  • The nature of the personal data;
  • Any court orders relating to Parental Responsibility that may apply;
  • Any consequences of allowing those with parental responsibility access to the child's information. This is particularly important if there have been allegations of abuse;
  • Any detriment to the child if people with parental responsibility cannot access this information; and
  • Any views the child has on whether their parents should have access to information about them.

8. Applications by Care Leavers

Whenever an application is received from a care leaver, it is important that the request is acknowledged promptly and in writing, or other appropriate forms of communication as required. The care leaver should be informed about the process and procedure, timescales for dealing with such requests and the services that the authority is able to provide.

An acknowledgement should be sent to the care leaver within ten working days confirming that records exist. If the authority knows that the care records do not exist, there should be no delay informing the care leaver of this fact. The letter should also indicate when they are likely to receive information from the care records and that:

  • The local authority will locate all existing records relating to the care leaver, including registers from children’s homes. Legislation requires that a child;s case record must be kept until the 75th anniversary of the child's date of birth;
  • There is a statutory duty to respond to a  subject access request within 40 calendar days. If it is not possible to meet this requirement, this should be explained to the care leaver, giving reasons and the timescale when the records will be available;
  • The care leaver will need to produce proof of their identity before the organisation can disclose any personal information however, if the person is already known the proof of formal ID is not required;
  • If the records cannot be located, the care leaver needs to be informed as soon as possible with information about the steps that will be taken to try to locate them. If records have been transferred to another local authority, the individual should be put in touch with the relevant department if this can be done. When records have been destroyed or mislaid, the care leaver must be informed as soon as possible and assistance given to assist the care leaver to locate other information and registers that may be available, such as, health and education records. 

It is important that the case worker responding to the request has telephone or direct contact with the care leaver to introduce themselves and explain the process. This provides an opportunity for the care leaver to discuss what they are hoping to obtain from their records, how s/he would like these to be shared and what they already know about their family and history. The case worker can also offer and identify what support, if any, the care leaver would like to receive. The care leaver should be assured that s/he will receive comprehensive information about their family background and time in care including information already known to them. It is important to offer to telephone the care leaver after they have received and read their records and to inform them that the case worker is available to try and answer any questions or concerns they may have.

Local authorities should respond to requests from a direct descendant of a care leaver if information about family history is being sought.

For further information see Children Act 1989 Guidance and Regulations Volume 3: Planning Transition to Adulthood for Care Leavers (revised January 2015) paragraphs 4.21 - 4.37 Access to Records.

9. Application by Agents

A request for access to records may be made through an agent (for example, a solicitor).

It is the agent's responsibility to produce satisfactory evidence that he or she has authority to have access to the records. This will always include proof of their identity.

The Manager will decide whether the representative will be allowed access, having sought Legal Advice if necessary.

10. Application on Behalf of Deceased Persons

Where a request is received for access to the records of some-one who has died, the person making the application should be asked to explain in writing their relationship to the deceased person, what information is needed and why. The social worker should make a decision in consultation with his or her manager and advise the applicant in writing of the decision with reasons.

11. Corrections or Erasure of Records

If a person considers that any part of the information held on his or her records is inaccurate, he or she has the right to apply in writing for it to be corrected or erased.

If the objection is justified, there is a duty to correct or erase the appropriate information.

12. Refusal of Access

If the worker considers there are reasons to refuse a request for access to all or any part of the records (see Section 2, Exceptions), this should be discussed with his or her manager and legal advice should be obtained.

The line manager should be asked to make a final decision on refusal of access, having sought legal advice if required. If refused, the date of the request and reason for refusal must be recorded in the file.

The decision and the reasons for it should be confirmed in writing to the person requesting access, or in a format appropriate to the needs of the person concerned.

13. Appeals Process

The person concerned has the right to apply to the Court for an order to disclose, correct or erase information held. They also have a right of appeal to the Information Commissioner who may make an assessment about whether the law has been complied with and issue enforcement proceedings to make the Authority comply with the request if necessary and/or recommend an application to court alleging a failure to comply with the Data Protection Act.

Appendix 1: Confidentiality and Access to Records Leaflet

Click here to view Appendix 1: Confidentiality and Access to Records Leaflet.