Subject access requests (SAR)

Version 1.2, 13 March 2025

This guidance is part of the Information governance and data protection section of the Good practice guidelines for GP electronic patient records.

The UK General Data Protection Regulation (UK GDPR) gives individuals the right of access to their personal data from any person or organisation that holds information about them. This right is commonly exercised through a ‘subject access request’ (SAR).

What you need to know from a digital primary care perspective

A patient may ask you for the information you hold about them. The request can be made in writing, by email or verbally.  It can be submitted to any part of the organisation and does not have to be directed to a specific person.

Providing patients with online access to their GP record will empower them to access their record themselves.  It should, therefore, reduce the number of SARs you receive.  If you have other forms of records about the patient that are not held in a digital format, SARs will also apply to those records as well.

It is important to remember there may be other parts of the clinical record that are not visible through online access methods (for example, audit trails or internal messages passed between members of the team that relate to a patient’s record). There may also be e-mail communication held elsewhere within the practice that will also fall under the remit of a SAR if these records identify the patient.  For example, an internal email from a receptionist to a nurse about a missed appointment would be subject to a SAR if the content identifies the patient.

The following links will take you to further formation:

Other helpful resources

Contact Information

Please email the Good Practice Guidelines team here for more information on this subject.

This email address is not intended for use by members of the public, patients and their representatives who should instead contact the NHS England Customer Contact Centre – england.contactus@nhs.net

NHS colleagues and contractors should use this mailbox for queries relating to the management of the GPGv5 and should contact the relevant NHS England team or programme for further information on topic content.