Data Subject Rights and Support Process

This document explains how a request to exercise a data protection right is handled where MyOracy is involved. It applies to pupils, staff, parents and guardians, institutional administrators, and anyone else whose personal data reaches the platform. It is the operational companion to the MyOracy Privacy Policy, and where the two describe the same thing, the Privacy Policy governs.

One point determines the shape of everything that follows. For pupil and staff data, the institution is the data controller and MyOracy is the processor. A data subject's rights under Articles 15 to 22 are exercised against the controller. MyOracy cannot answer a request about pupil data on its own initiative, cannot decide what to disclose, and cannot decide what to withhold, because none of those are a processor's decisions to make. What MyOracy does is assist the institution to answer, promptly and completely, under Article 28(3)(e).

This is not slower than the alternative. The institution already holds the pupil's record, the relationship with the family, and the context needed to decide questions this document cannot decide in the abstract. What it does not hold is the platform data, and Section 03 sets out how quickly MyOracy supplies it.

A request is valid however it arrives. No form is required, no particular phrasing is required, and there is no need to mention the GDPR, data protection, or any statutory provision. A request is valid if it is clear that the person is asking about their personal data. It may be made in writing, by email, or verbally, and in any language.

If a request reaches MyOracy directly from a pupil or a parent, it is not refused and it is not returned unanswered. It is acknowledged, forwarded to the institution the same working day, and the sender is told plainly who now holds it and who will reply. Nobody is sent away to start again.

The institution has one month to answer. If MyOracy took a month to supply the platform data, the institution would have none. MyOracy therefore works to five working days from receipt to supply, and commits to that contractually in the Data Processing Agreement rather than merely describing it here. The nine stages are set out in full at Section 13, which is published so that an institution reviewing us can inspect the process rather than take it on trust.

MyOracy does not disclose pupil data to a data subject directly. The export goes to the institution, which decides what is released, applies any exemption, and answers the requester. Where MyOracy identifies material that in its view raises a question the institution should consider, for example third-party speech in a transcript, it is flagged rather than resolved. See Sections 07 and 09.

The last row is the one that surprises people, and it is worth stating in words as well as in a table. Speech audio is never written to disk. It exists in memory for the duration of transcription and is then discarded, so there is no recording of a debate or an oracy session anywhere in MyOracy's systems, and no recording that could be produced in response to any request, by anyone, for any reason. This is a property of the architecture rather than a retention rule that could be varied.

Retention limits what can be retrieved in a second respect. A transcript requested after its retention period has expired cannot be produced, because it has been deleted. Where that is the position, MyOracy tells the institution so plainly, with the date the record would have been deleted, so that the institution can give the requester a real answer rather than an ambiguous one.

Verification of identity is ordinarily the institution's task, because the institution knows its own pupils and staff and MyOracy does not. Where MyOracy does need to verify, the checks are proportionate to the sensitivity of the data and to what is actually in doubt.

Where identity genuinely cannot be established at the outset, the response period does not begin until it has been. That mechanism exists to protect the data subject from disclosure to the wrong person, and MyOracy does not use it to buy time. Any decision to pause is recorded in the Rights Request Register with the reason.

There are two clocks and they should not be confused. The statutory clock runs against the institution as controller: one month from receipt, extendable by a further two months for complex requests. The MyOracy clock is internal, much shorter, and exists so that the institution has most of its month left when our part is finished.

The Data (Use and Access) Act 2025 also confirmed that a controller's obligation is to conduct a reasonable and proportionate search rather than an exhaustive one. MyOracy applies the same standard to the search it performs on the institution's behalf, and documents the search so that the institution can demonstrate it if asked.

A debate transcript is a single record containing the speech of several people. A pupil who asks for their personal data is entitled to their own contributions. Whether any part of another pupil's speech should be disclosed alongside it is a judgement about third-party data under Article 15(4), and it is the institution's judgement to make, not MyOracy's.

This arises more often on this platform than it would on most, because argument is responsive by nature. A pupil's own speech frequently quotes, characterises, or rebuts what an opponent said moments earlier, and separating the two cleanly is not always possible without destroying the sense of the record.

Where a transcript contains something a pupil disclosed about themselves, and disclosure to a parent may not be in that pupil's interests, the question is a safeguarding one before it is a data protection one. MyOracy flags it to the institution's designated safeguarding lead as well as to its data protection lead, and takes no further step of its own. See the Acceptable Use Policy, Section 08.

An access response must include supplementary information as well as the data itself. That obligation falls on the institution as controller, but most of the answers concern MyOracy's systems and would be difficult for a school to write accurately. MyOracy therefore supplies the following alongside every export, drafted so that the institution can incorporate it directly.

Exemptions under Schedule 2 to the Data Protection Act 2018, and the equivalent provisions in EU Member State law, are applied by the controller. MyOracy does not apply an exemption to pupil data, does not refuse a request on the institution's behalf, and does not decide that a request is manifestly unfounded or excessive. Those are all controller decisions, and a processor that made them would be exceeding its instructions.

Where anything is withheld, the requester is entitled to be told what has been withheld, which exemption is relied on, and how to challenge the decision. That explanation comes from the institution, and MyOracy supplies whatever the institution needs to give it accurately.

MyOracy is the controller for a small and separable set of records: correspondence with institutional contacts, support requests, contract and billing administration, and the security and diagnostic logging of the service itself. A request about those records comes to MyOracy directly and is answered by MyOracy in full, within one month of receipt, with the same pause mechanisms as apply to any controller.

A request from a pupil almost never falls into this category. It is set out because a school's data protection lead needs to know exactly where the line sits, and because saying the school is always the controller, without qualification, would be inaccurate.

Anyone who believes their personal data has been handled unlawfully may complain. A complaint about the handling of pupil data is made to the institution, which is the controller. A complaint about MyOracy's handling of the narrow category at Section 10 is made to MyOracy. A complaint may also be made about MyOracy to the institution, which will raise it with us under its Data Processing Agreement.

The right to complain directly to a controller was placed on a statutory footing by the Data (Use and Access) Act 2025, and the provisions requiring controllers to operate a complaints process came into force on 19 June 2026. No prior request is needed, no particular wording is needed, and nobody is required to exhaust an internal process before going to a supervisory authority.

Anyone dissatisfied with the handling of a request or a complaint may escalate to a supervisory authority or seek a judicial remedy, at any time, without exhausting any internal process first. Where the complaint concerns pupil data, the relevant controller is the institution, and the supervisory authority will ordinarily deal with the institution.

The following is MyOracy's internal handling process, reproduced for institutional partners and data protection officers reviewing this document for procurement.