The UK General Data Protection Regulation (UK GDPR), which was implemented in the UK through the Data Protection Act 2018, gives individuals the right of access to their personal data from any health and care organisation that holds records on them. This right is commonly referred to as ‘subject access request (SAR)’.

Guidance for patients and service users

A SAR is a request that can be made in writing, by email or verbally asking for access to the personal information a company or organisation holds on you (e.g. your GP surgery). This is a legal right that any individual in the UK is entitled to exercise at any point for free. 

You can ask someone else to submit a subject access request for you, for example, a solicitor or family member acting on your behalf. You may be asked to provide confirmation that you have asked them to do this.

Whilst a SAR gives you the right to obtain a copy of your personal data, it should be noted that there are other ways to obtain your health and care records. The NHS is seeking to empower people and transform their experience of health and care by giving them the ability to access, manage and contribute to digital tools, information and services - for example, most patients can now request access to their GP record online, including via the NHS App.

From receiving a SAR request, the organisation has one month to action and respond.

Can children make a request?

All patients and service users have a right to access their own health and care records, including children. A child with competency (meaning they are considered mature enough to understand the situation) can exercise their own subject access rights. Generally, children aged 13 and over, are considered competent. If they are not deemed competent, a person with parental responsibility may be permitted to exercise the child’s right to make a SAR on their behalf if it is evident, they are acting in the child’s best interest.