What is a Subject Access Request?
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to access personal data that we hold about you.
This is called a Subject Access Request (SAR).
You can request:
- Copies of your medical records
- Details of how your data is being used
- Who your data has been shared with
- How long we keep your information
What Can You Request?
You can ask for access to:
- Your full medical record
- Specific information (e.g., a letter, test result, or time period)
- Information about how your data has been shared
- A summary of why and how your data is processed
How to Make a Subject Access Request
You can make a SAR:
- In writing (by email or letter or using our forms on our website)
- In person at the practice
- Over the phone, though we may ask you to follow up in writing for clarity
You do not have to use a special form, although we have one if you would like to use it- please try to include:
- Your full name, address, and date of birth
- Details of the information you’re requesting
- Any specific dates or details to help us locate the data
Is There a Cost?
No, Subject access requests are free of charge.
However, we may charge a reasonable fee if:
- You request multiple copies of the same information
- The request is excessive or repetitive
How Long Will It Take?
We aim to respond within 1 calendar month of receiving your request.
In complex cases (e.g. large records), this may be extended by up to 2 more months, but we will tell you if that’s the case.
How Will You Receive the Information?
We can provide the information:
- As paper copies
- By secure email
- On an encrypted USB (if agreed)
Let us know your preferred format when making the request.
Identity Checks
To protect your privacy, we may ask you to confirm your identity before releasing any information.
This could include showing:
- A valid photo ID (e.g. passport, driving licence)
- A recent utility bill or other proof of address