Each is treated differently. One is fully exempt, one is exempt but conditional, and one only delays disclosure rather than blocking it. This guide sets out exactly how the DSAR references and exams exemption works for each of the three, so your team applies the right rule to the right document.
What is the DSAR references and exams exemption?
The DSAR references and exams exemption is a group of three related rules in the Data Protection Act 2018, covering confidential references, exam scripts, and exam marks. Each has its own scope. None of the three works the same way as the others.
Are confidential references exempt from a subject access request?
Confidential references given for the purposes of education, training, employment, or a similar purpose are exempt under Schedule 2, paragraph 24 of the Data Protection Act 2018.
The exemption applies regardless of whether the request is made to the person who wrote the reference or to the organisation that received it. Both sides of the reference are protected under the same rule.
Are exam scripts exempt too?
Yes, and this exemption is unusually absolute. Exam scripts, the candidate’s answers themselves, are completely exempt from the right of access. No proportionality or prejudice assessment is required.
This is one of the few DSAR exemptions in the Data Protection Act 2018 that applies without any balancing test. There is no need to weigh harm against benefit. The script itself simply falls outside the right of access.
What about exam marks — are they exempt or just delayed?
Exam marks are not withheld outright. They are delayed. The normal one-month SAR deadline does not apply to them.
Instead, the deadline is whichever comes first: five months from the date of the request, or 40 days from when the results are announced. This is a genuine deadline, just a different one. It is not a permanent exemption from disclosure.
Why does the DSAR references and exams exemption exist?
Each part of this exemption exists to let an assessment, a reference, or an exam process finish properly, without a subject access request disrupting it partway through.
They are about protecting the integrity of an ongoing process, not permanently hiding the outcome from the individual once that process concludes. Precise handling matters here. Applying the wrong rule to the wrong document type is a common, avoidable error.
What happens if the wrong rule is applied to the wrong document?
Applying the exam-marks delay to a reference, or treating a reference as fully exempt when it should only be partially protected, creates unnecessary complaints and delay. Each of the three rules needs to be matched precisely to the document type in front of the reviewer.
A practical example of the DSAR references and exams exemption
Consider a university handling a SAR from a recent graduate. The case file includes a confidential academic reference, the candidate’s original exam scripts, and provisional exam marks issued two weeks earlier.
The reference is exempt under Schedule 2, paragraph 24, regardless of who is asked for it. The exam scripts are absolutely exempt, with no balancing test at all. The exam marks are not exempt outright. They are simply subject to the extended deadline, whichever is earlier of five months from the request or 40 days from the results.
Treating all three documents the same way, either by disclosing the exam scripts or by permanently withholding the marks, would both be wrong. Matching the correct rule to each document type is what keeps the response defensible.
Frequently asked questions about the DSAR references and exams exemption
Can a confidential reference always be withheld? Yes. References given for education, training or employment purposes are exempt under Schedule 2, paragraph 24, whichever side of the reference the request comes from.
Do exam scripts ever need a harm assessment before withholding? No. Exam scripts are absolutely exempt, with no proportionality or prejudice test required at all.
Can an organisation withhold exam marks indefinitely? No. Exam marks are only delayed, not exempt. The deadline is whichever comes first of five months from the request or 40 days from the results.
What is the most common mistake with this exemption? Applying one of the three rules to the wrong document type, such as treating a reference as if it were an exam script, or vice versa.
Key takeaways on the DSAR references and exams exemption
- The exemption covers three different document types: confidential references, exam scripts, and exam marks.
- Confidential references are exempt under Schedule 2, paragraph 24, regardless of who is asked.
- Exam scripts are absolutely exempt, with no balancing test required.
- Exam marks are only delayed, not exempt — track the extended deadline carefully.
- Match the correct rule to the correct document type to avoid unnecessary complaints.
Why getting the DSAR references and exams exemption right matters
Education and training providers handle these three document types constantly, often at scale during exam season. Getting the rule wrong on even one document type can create a wave of unnecessary complaints. Getting the deadline wrong on exam marks is just as risky, since a missed deadline is itself a compliance failure.
A structured process, applied consistently across every case, keeps references, scripts and marks handled correctly every time. It also gives the organisation a clear, evidenced answer if a requester or the ICO ever questions the decision.
Manual assessment vs a structured DSAR redaction tool
| Factor | Manual, ad hoc assessment | ProvePrivacy DSAR Redaction Tool |
|---|---|---|
| Applying the correct rule per document type | Easy to confuse exemption, delay, and full disclosure | Structured exemption library keeps each rule separate |
| Tracking the exam-marks deadline | Manual diary tracking, easy to miss | Deadline logic built into the case workflow |
| Evidencing the confidentiality of a reference | Rationale often undocumented | Documented decision and rationale per redaction |
How does ProvePrivacy help with the DSAR references and exams exemption?
ProvePrivacy is the affordable GDPR compliance software built for data protection teams in resource-constrained, mid-market organisations. It’s a genuine OneTrust alternative, with all modules included and unlimited users.
Its DSAR management software includes a built-in DSAR Redaction Tool, available as standard to every client. It applies exemptions for references and exams consistently, with a documented rationale for every decision.
Book a demo today to see how ProvePrivacy’s RoPA, risk, incident and DSAR modules work together in one governed platform.