This guide covers the SAR exemptions for references and exams under the Data Protection Act 2018.
A candidate asks for their exam marks before results day, or a reference request lands from someone who wasn’t the one who wrote it. Do you have five months to respond, or 40 days? Is the reference even yours to withhold? This is exactly where the SAR exemptions for references and exams come in, and each of the three protections in this group works in a completely different way.
Confidential references given for education, training, employment or a similar purpose are exempt under Schedule 2, paragraph 24, and unlike the old 1998 Act, that protection now travels with the reference wherever it sits, whether the candidate asks the person who wrote it or the organisation that received it. Exam scripts are exempt outright, with no proportionality test at all. Exam marks are never withheld outright, only delayed, and the deadline is whichever of five months from the request or 40 days from the results comes first, not last, a detail that trips up more exam boards than any other exemption in this series.
Why the references and exams exemptions all protect a live process
The SAR exemptions for references and exams exist to let an assessment, a reference or an exam process finish properly, without a subject access request disrupting it partway through. None of the three is about hiding the outcome permanently, only about protecting the process while it’s still live.
This guide walks through all three protections in detail, including exactly where the reference exemption’s scope now sits following the change from the 1998 Act, and the correct way to calculate the exam marks deadline.
Once you know which protection applies and for how long, precise handling of what’s disclosed matters just as much. The ProvePrivacy platform’s DSAR Redaction Tool, available to every client, is built to apply exemptions like these directly against a case file. Download the full guide below to see exactly where each deadline and each protection sits.