How do I get copies of my records?
You almost always need to make a request to see your records in writing. This is called a subject access request (SAR).
A subject access request can be:
- an email or a letter requesting copies of your records
|
Sample subject access request letter
Download a sample subject access request letter (Word doc or PDF).
|
- a standard form an organisation may have to request access to records
- a non-standard form, such as through an organisation’s website or social media account – for example Facebook or Twitter. However, this may lead to a delay in your request being dealt with, as it's unlikely that the team responsible for social media will be the same team responsible for dealing with subject access requests. This means they may not recognise your request as a subject access request. There may also be practical difficulties in relation to you being able to prove your identity if you make your request in this way.
Under equality law organisations have a legal duty to make their services accessible. If your mental health problem makes it impossible (or unreasonably difficult) for you to make a request in writing, an organisation may have to make a reasonable adjustment to its normal data protection policy. This could mean that it treats a verbal request as a valid subject access request.
When preparing your subject access request:
- Provide enough detail about the records you wish to see. If your request is too vague, the organisation might ask you to be more specific. This could cause a delay in getting the information you want.
- Think about exactly what you want to see – for example your social services records for a particular period of time or medical records held by a particular doctor.
- Avoid asking for information that is too general – for example “all information that the Council holds about me”. Although you can ask for this, you may end up with information that is not relevant. It might be better to ask for all of the records held by a particular service or department – for example “all of my social services records” or “a copy of my personnel file”. It's a good idea to mention that you’re making a subject access request under the Data Protection Act 2018.
- Send your request by recorded delivery or by email. This will mean that you have proof of the date your request was sent. You should also keep a copy of your letter or subject access request form, and any other relevant correspondence. This will be important evidence if you need to make a complaint.
- Provide proof of identity. The organisation needs to make sure that you are who you say you are. You might be asked for a photocopy of your passport, driving license or a utility bill. However, if the person you make the request to knows you well, you shouldn't need to provide detailed proof of your identity.
How long will it take to get a response?
As of 25th May 2018, organisations have one calendar month to respond to your subject access request starting from the day they receive your request (before this date the time limit was 40 days).
If the organisation thinks that your request is very complicated then it can extend this to three months, but they must write to you to explain why the extension is necessary.
Will I have to pay?
As of 25th May 2018, organisations are not allowed to charge a fee for supplying your data unless your request is manifestly unfounded or excessive (before this date organisations could charge up to £50.00).
If an organisation decides it is appropriate to charge you for an excessive request, the amount must be based on how much it will actually cost them to fulfil your request.
Subject Access Requests: Quick Checklist
|
1. Think about the personal information you wish to see.
2. Identify which organisation holds this.
3. Check their website or call them to find out:
- who to send the subject access request to
- whether the organisation has a standard subject access request form
- what form of proof of identification the organisation needs.
4. Draft your subject access request letter or complete the form (if the organisation has one).
5. Send to the relevant contact at the organisation with proof of identification. Ideally, send the request by recorded delivery so that you can track the request.
6. Keep a copy of the letter or subject access request form you have sent.
7. Put the deadline for them to get back to you in your diary – one calendar month after receipt by the organisation.
Tip: If you can send appropriate proof of identity at the same time as making your subject access request, it should make the process quicker.
|
