How to handle a subject access request (SAR)

Subject access requests (SARs) are a legal right under the UK General Data Protection Regulation (UK GDPR), allowing individuals to ask for a copy of their personal data. In general practice, these requests most often come from patients - but can also be made by solicitors, third-party agencies, or even staff. Handled well, a SAR is an opportunity to demonstrate transparency and trust. Handled poorly, it can lead to delays, complaints, or even regulatory action. This guide walks you through the key steps to managing SARs confidently and compliantly, while staying on the right side of the law - and your patients. 

What is a subject access request? 

A subject access request is any request made by an individual for access to the personal data your organisation holds about them. In general practice, this could include: 

• Medical records. 

• Correspondence about the patient. 

• Consultation notes. 

• Test results or referrals. 

• Staff notes recorded about the patient. 

Under the law, you have one calendar month to respond to a SAR, and you cannot charge a fee, unless the request is manifestly unfounded or excessive. 

Who can make a SAR? 

• The patient themselves. 

• A parent or guardian (for children, depending on age and capacity). 

• A third party with the patient’s written consent (for example, solicitor, insurance company). 

You must always verify the identity and legal authority of the requester. This may involve requesting ID and consent documentation. 

How to respond to a SAR - step by step 

1. Acknowledge and log the request 

Log the date the request was received and who submitted it. Note the one-month deadline - this includes weekends and holidays. You should also: 

• Assign a responsible person to manage the request. 

• Use a standard SAR log or template (many ICBs provide one). 

• Add it to your practice’s IG calendar or risk tracker. 

If you need more information from the requester to proceed (for example, clarify date range or consent), the one-month clock pauses until you receive it. 

2. Confirm identity and consent 

• Ask for photo ID if the requester is unknown to you. 

• If it’s a third party (solicitor, insurer), ask for signed consent from the patient. 

• Ensure the consent clearly states what information may be shared and with whom. 

If the request is made by a parent, check the child’s age and ability to understand. You may need to assess Gillick competence. 

3. Gather the relevant records

Collect only the data that falls within the scope of the request. This might involve: 

• Searching EMIS, SystmOne, or your clinical system. 

• Extracting correspondence (for example, hospital letters). 

• Printing or exporting clinical notes. 

• Redacting third-party information (see below). 

Avoid sharing: 

• Notes about other individuals (including staff). 

• Confidential third-party information. 

• Data not relevant to the patient. 

• Information that could cause serious harm. 

If unsure, consult your Caldicott Guardian or Data Protection Officer (DPO). 

4. Redact carefully and review 

Before sharing the records: 

• Redact any third-party information, unless consent has been obtained. 

• Ensure safeguarding or risk information is appropriately considered. 

• Check for abusive or threatening language (which may need redaction or context). 

You should document your redaction process in case of future challenge. 

5. Send securely and confirm receipt 

Provide the response in the patient’s preferred format, where possible. This could be: 

• Printed and collected in person (with ID check). 

• Posted securely via recorded delivery. 

• Sent electronically through a secure system or encrypted email. 

Provide a cover letter outlining what is included and who to contact with questions. 

6. Close the request 

Once completed, record: 

• The date the SAR was fulfilled. 

• Who reviewed and approved it. 

• Any exemptions or redactions applied. 

• How the data was shared. 

Keep this log securely - it may be needed for audit or complaint resolution. 

Common pitfalls - and how to avoid them 

What if the request is complex? 

If the SAR involves particularly large amounts of data, or you need more time to locate and review it, you can extend the deadline by a further two months - but you must notify the requester within the first month, explaining why. 

Where to get help 

• Your DPO or ICB Information Governance lead. 

• NHS England guidance on subject access. 

• ICO SAR guidance: ico.org.uk. 

• Local CSU or IT support for redaction tools. 

Final word: make it routine, not rushed 

Subject access requests don’t need to be a panic-inducing chore. With clear templates, strong processes, and a shared understanding across the team, they become a manageable - and even helpful - part of your practice’s data responsibilities. Patients have a right to see their records. You have a right to respond in a way that protects privacy, safety, and trust.