Subject Access Requests Following Implementation of UK GDPR
On 25 May 2018 the current UK Data Protection Act 1998 (DPA 1998) will be fully replaced by the UK General Data Protection regulation (2016/679).
As with DPA 1998 these new regulations give living individuals the right to request access to personal data held on them by the practice. This is known as Subject Access Request (SAR).
Requesters must be either, the data subject OR have the written permission of the data subject OR have legal responsibility for managing the subject's affairs to access personal information about that person. It is the requesters responsibility to satisfy the practice of their legal authority to act on behalf of the data subject.
The practice must be satisfied of the identity of the requester before we can provide any personal information.
Download the Subject Access Request Form (PDF, 31KB)
Timeframe for responding to requests
The statutory timeframe has now been reduced to at least one month of receipt of the request, and in any event without delay.
The period of compliance can be extended by a further two months where requests are determined to be complex or numerous.