Subject Access Requests (SAR) Policy
Terms used
Data Controller
This is the controller of the data and the system, as defined in the Act. In this case the Controller is The Medical Centre.
Data Subject
This is the person whose image is within the system, and who has rights of access as determined under the Act.
Third Party
A person or body other than the Data Subject who requests access, or to whom an image may be provided.
Data protection act and GDPR
The UK Data Protection Act and EU GDPR specify the rights of access of Data Subjects.
All requests for access must be in writing on a Data Access form which will be provided on request.
The form must be fully completed. A response will be provided within 1 month if possible; however this may be extended by a further 2 months if a request is deemed as particularly complex or excessive. If the request is deemed as complex or excessive, the Data Subject/Third Party requesting the SAR will be informed within 1 month of request and informed why the extension is necessary.
If a request is deemed to be manifestly excessive or unfounded, a fee may be charged which will not exceed the reasonable costs associated with producing the copy. The requesting party will be informed within 1 month if a request is deemed manifestly excessive or unfounded.
Where an application is declined, a reason will be given. In some circumstances, some parts of your record may be withheld.
How to make an access request
- You can download a Subject Access Request form (DOCX, 24KB); alternatively you can request a paper copy from the surgery in person.
- Ensure that the form is fully completed, using a separate sheet of paper if necessary, and return it to the address below.
- Upon completion of the SAR, the copies will be made available to the Data Subject who will be responsible for forwarding them to any Third Parties.
- At the point of release, the copies will become the property of the Data Subject and any further requests for the same copies will be deemed as excessive and will therefore be met with a charge. It is therefore advised that the Data Subject keep the originals and make copies available to any Third Parties they wish to have them.
There is no facility for immediate access.
Send the application to:
SAR Requests
The Medical Centre
2 Frances Street
Doncaster
DN1 1JS
Information and third parties
The practice may share your personal information with other NHS organisations where this is appropriate for your healthcare.
In other circumstances we may approach you for specific consent to release personal information to third parties.
Information will not normally be released to other family members without written patient consent.
In some circumstances there are statutory or ethical obligations to disclose information to others (such as public health issues) which may not require your consent, however you may be consulted about these in advance.
All staff have access to your medical and personal details which is required in relation to their roles, and have completed confidentiality agreements.