Subject access requests (SAR)

This guidance will help patients and service users to understand what a subject access request (SAR) is. It also supports information governance (IG) professionals to respond to SARs in a timely manner.

Guidance for patients and service users

ARTICLE

Subject access requests (SAR) guidance for patients and service users

This guidance will help patients and service users to understand what a subject access request (SAR) is and how they can make a request. It also supports staff and IG professionals to respond to Subject Access Requests in a timely manner.

Guidance for health and care professionals

As someone supporting the health and care of patients and service users, you need to understand that people have the right to access copies of their information.

You should also know who in your organisation is responsible for responding to SARs. Your organisation has 1 month to action and respond to a SAR so you need to forward the request to the appropriate person or team as quickly as possible.

If you are a health and care professional, you may also be involved in reviewing the response or deciding whether certain information should be released. For example, you may need to carry out a serious harm review. This is to ensure information which would be likely to cause serious harm to the physical or mental health of any individual is not released.

If you are involved in responding to a request, see the section for IG professionals for further information. The IG lead, Caldicott Guardian or senior team will also be able to provide guidance and assistance where necessary.

Guidance for IG professionals

ARTICLE

Subject access requests guidance for IG professionals

Training

ARTICLE

Managing subject access requests training

This session is aimed at members of staff who are managing subject access requests (SARs), taking on responsibility for SARs or providing data for SARs. These are most likely to be certain information governance staff, health and care professionals conducting a serious harm review for a SAR, human resources staff, support function or administrative staff, legal services staff or records services staff.

Updates since original publication

Read the updates since original publication

April 2026:

Updated guidance on subject access requests incorporating new considerations introduced by the Data Use and Access Act (DUAA) 2025.

April 2025:

Patients and service users section:

Information for young people and those with parental responsibility updated to align with training.

IG professionals section:

Guidance on SARs relating to young people updated.

Appropriate professionals to conduct serious harm reviews clarified.

These IG pages provide clear and consistent IG advice and guidance to patients and service users, health and care staff and IG professionals. NHS England convenes a working group to check and challenge the guidance.

Last edited: 7 May 2026 12:51 pm