Subject access requests (SAR) guidance for patients and service users

You have a legal right to ask for a copy of the personal information a health or care organisation holds on you. Asking for this information is known as making a subject access request (SAR). You do not need to explain why you want the information, and in most cases the information is free of charge.

You can make your request to any part of the health and care organisation. You don’t need to find a specific person in the organisation to direct your request to. However, an organisation’s privacy notice (available on their website) may provide the contact details for the Data Protection Officer (DPO) or give more information about how you can easily make a SAR request. You can also make your request in different ways, for example, face to face, by phone or in writing including by email or via social media.

If an organisation has a form, completing it may help them to find the information you are asking for more easily. If they do not have their own form, you can complete our SAR form and check with your health and care organisation who to send it to.

You may be asked to provide proof of your identity, for example, to supply a driving licence, passport or a marriage or a birth certificate.

You can request many different types of information that are held about you. For example:

• information from your health and care record
• information about who your record has been shared with
• communications about you, for example emails, text or mobile messages

You can request a specific piece of information, or all the information that an organisation holds on you.

The organisation must respond within 1 calendar month of you making the request, although that time may be extended up to 3 months if the request is complex. However, if this is the case you will be told of the extension within the first calendar month.

Someone else can submit a SAR for you for example, a solicitor, family member or friend acting on your behalf. They will need to provide evidence that you have agreed to the request, such as a signed consent form.

If you have a registered lasting power of attorney for health and welfare for someone who has lost capacity, you can submit a SAR on that person’s behalf. The lasting power of attorney status will need to have been registered with the Office of the Public Guardian.

If you do not have a registered lasting power of attorney for health and welfare but you can provide evidence that you are acting in someone else's best interests (and they lack capacity) then your request will be considered. An example is where you were supporting someone who lacks capacity with a move to a new care home.

You can make your own SAR as a young person as long as there is evidence that you adequately understand your rights. Typically, young people aged 12 and over are considered to have a good enough understanding to submit a SAR unless there is information to suggest otherwise. For young people under 12, they may also be able to submit their own SAR as long as there is evidence that they also understand their rights.

A young person can exercise their own data protection rights so long as they are deemed competent to do so. Typically, a young person aged 12 and over would be considered competent to make a SAR, unless there is information to suggest otherwise. Therefore, in most cases SARs made by a person with parental responsibility on behalf of a young person aged 12 or over will need the consent of that young person.

Similarly, there may be information to suggest a young person under 12 has adequate understanding to be considered competent to make a SAR.

If a young person of any age does not have sufficient understanding to exercise their rights themselves or consent to their parent exercising their right for them, health and care organisations may allow a person with parental responsibility to exercise the young person's right to make a SAR (so long as this is considered to be in the best interests of the young person). If so, you may be asked to provide proof that you have parental responsibility for the young person.