Subject Access Request Policy
This policy provides the Practice with a process for the management of requests for personal information (for living individuals) under the Data Protection Act (DPA), the General Data Protection Regulations (GDPR) and (for deceased individuals) the Access to Health Records Act 1990.
Under the Data Protection Act, subject to certain conditions, an individual is entitled to be:
- Told whether any personal data is being processed;
- Given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people; and
- Given a copy of the information comprising the data; and given details of the source of the data (where this is available).
Individuals wishing to exercise their right of access should:
- Make a written application to the Practice holding the records, including via email
- Provide such further information as the Practice may require to sufficiently identify the individual
The request must be complied with without delay and at least within one calendar month of receipt of the request. This period can be extended for a further two months where requests are complex or numerous, however the Practice must inform the individual within one month of receipt of the request and explain why the extension is necessary.
Complaints And Appeals
The applicant has the right to appeal against the decision of the Practice to refuse access to their information. This appeal should be made to the Practice Manager.
If individuals remain unhappy with the Practice response, they have the right to appeal to the Information Commissioner’s Office:
Information Commissioner’s Office
Telephone: 0303 123 1113