The General Data Protection Regulation (GDPR), which was implemented in the UK through the Data Protection Act 2018, gives individuals the right of access to their personal data from any health and care organisation that holds records on them. This right is commonly referred to as ‘subject access’ or SAR.
Whilst a SAR gives you the right to obtain a copy of your GP held medical records, it should be noted that there are other ways to obtain your health and care records. The NHS is seeking to empower people and transform their experience of health and care by giving them the ability to access, manage and contribute to digital tools, information, and services – for example, patients can now request access to their GP record online, including via the NHS App.
You can apply as a third party for someone that you are responsible for, including for a child, or for someone who has died. You will need to provide proof that you are allowed to act on their behalf. Health records are confidential so you can only access someone else’s records if you are authorised to do so. Making a request for a child – Please note, if a child is considered competent, they should make the request themselves or give consent to a third party to make the request on their behalf. Making a request for someone that you have power of attorney for. (Please ensure power of attorney documents are official and/or poses a corporate heading and include medical/health care)
Our response
We will usually process your request within 30 days from receipt. Following your request, we may write back to you within the 30-day time frame to request you to narrow or modify your requirements. This may also result in an extension of a further 60 days whilst we examine your request. Ensure the request is not excessive, whether a request is excessive depends on its circumstances. A request may be excessive if it repeats the substance of previous requests and a reasonable interval has not elapsed; or overlaps with other requests. Information is provided in line with the General Data Protection Regulations (GDPR), Chapter 3, Article 15 (Recitals 63 & 64).
Our preferred method of delivery is via email. Any documents sent will be sent securely via Egress.
If you are unable to receive by email, please speak to the secretary team to discuss alternative secure methods.
To request SAR
A Subject Access Request can be made by following the below link.
To make a subject access request you will need the following information: