You have a legal right to ask for a copy of the personal information a health or care organisation holds on you. Asking for this information is known as making a Subject Access Request (SAR). You do not need to explain why you want the information, and in most cases the information is free of charge.

How do I make a SAR?

You can also make your request in different ways, 

1. In person at the practice in writing 
2. Via the website Online Click Here

An organisation’s privacy notice (available on their website) may provide the contact details for the Data Protection Officer (DPO) or give more information about how you can easily make a SAR request.

You may be asked to provide proof of your identity, for example, to supply a driving licence, passport or a marriage or a birth certificate  this helps the surgery keep your information safe

What  information can I request?

You can request many different types of information that are held about you. For example:

• information from your health and care record
• information about who has accessed your record and when
• communications with/about you for example emails or Mobile text messages which we use to contact you about appointments/ Health checks due.

You can request a specific piece of information, or all the information that an organisation holds on you.

When will I get a response?

The organisation must respond within one calendar month of you making the request, although that time may be extended up to three months if the request is complex. However, if this is the case you will be told of the extension within the first calendar month.

Can someone else make a SAR on my behalf?

Someone else can submit a SAR for you – for example, a solicitor, family member or friend acting on your behalf. They will need to provide evidence that you have agreed to the request, such as a signed consent form.

Can I make a SAR on behalf of someone I hold registered lasting power of attorney status for, where they lack capacity?

If you have a registered lasting power of attorney for health and welfare for someone who has lost capacity, you can submit a SAR on that person’s behalf. The lasting power of attorney status will need to have been registered with the Office of the Public Guardian.

If you do not have a registered lasting power of attorney for health and welfare but you can provide evidence that you are acting in someone else’s best interests (and they lack capacity) then your request will be considered. An example is where you were supporting someone who lacks capacity with a move to a new care home.

I’m a young person – can I make a SAR?

You can make your own SAR as a young person as long as there is evidence that you adequately understand your rights. Typically, young people aged 13 and over are considered to have a good enough understanding to submit a SAR unless there is information to suggest otherwise. For young people under 13, they may also be able to submit their own SAR as long as there is evidence that they also understand their rights.

I have parental responsibility – can I make a SAR on behalf of a young person?

A young person can exercise their own data protection rights so long as they are deemed competent to do so. Typically, a young person aged 13 and over would be considered competent to make a SAR, unless there is information to suggest otherwise. Therefore, in most cases SARs made by a person with parental responsibility on behalf of a young person aged 13 or over will need the consent of that young person.

Similarly, there may be information to suggest a young person under 13 has adequate understanding to be considered competent to make a SAR.

If a young person of any age does not have sufficient understanding to exercise their rights themselves or consent to their parent exercising their right for them, health and care organisations may allow a person with parental responsibility to exercise the young person’s right to make a SAR (so long as this is considered to be in the best interests of the young person).