The UK data protection authority (ICO) has published guidance on the application of the UK GDPR to the management and publication of exam results.
Under the UK GDPR, students can request access to their marks, examiners' comments, and appeal panel minutes, but not to copies of their answers. The request must be made in writing to the institution, which must respond within one month if the results are published. If the request precedes publication, the deadline is five months or 40 days after publication, whichever is sooner. The UK GDPR guarantees the accuracy of the recorded mark but does not allow contesting the examiner's decision, which falls under each institution's appeal procedures for procedural grounds, bias, or error.

The publication of results is an accepted practice that generally does not require consent, relying on the institution's legitimate interest. Schools must, however, inform students and their parents in advance about the publication methods and seriously consider any objections. An institution must have a valid reason to reject an objection. Regarding minors, the UK GDPR does not set an age to exercise these rights. A child's capacity is assessed on a case-by-case basis, although a child aged 12 or over is generally considered mature enough to understand their request.