Data Subject Access Request
All individuals have the right to apply to access any personal data that an organisation holds about them. The General Data Protection Regulation also gives individuals the right to give authorisation for someone else to make the application on their behalf.
How to contact us
Data protection legislation gives individuals the right to request access to personal data held on them by organisations. This is known as a Data Subject Access Request (DSAR).
Any individual can make a Data Subject Access Request (DSAR). In addition an individual may nominate a representative (such as a solicitor or relative) to apply on their behalf. In this case, there must be a valid consent signed by the individual who authorises the release of information to the representative.
A person who has parental responsibility for a young child can request access to the child’s records. Release of records is usually only made in the best interests of the child. Children may apply themselves – where it is considered that the child has the competence to be able to understand the nature and implications of making a DSAR. If they are considered competent, they should also be consulted regarding any request that has been made for their records by another individual, i.e. a person with parental responsibility. The competence of the child in respect of requests for records can be considered from the age of 12.
For mentally incapacitated adults a person may make a request on their behalf if they have been granted power of attorney or agent by a court to manage their affairs. The request must be made in relation to the management of their health and welfare.
Organisations may charge a fee if it has been defined as manifestly excessive or unfounded.
The Access to Health Records Act 1990 allows certain individuals to request access to a deceased patient’s health records.