Subject Access Requests
A subject access request (SAR) is simply a request made by or on behalf of an individual for the information which he or she is entitled to ask for under section 7 of the Data Protection Act 1998 (DPA). The request does not have to be in any particular form. It helps individuals to understand how and why you are using their data, and check you are doing it lawfully.
Under the GDPR, organisations must respond to a SAR ‘without undue delay and in any event within one month of receipt of the request.
An individual is only entitled to their own personal data, and not to information relating to other people (unless the information is also about them or they are acting on behalf of someone).
If an individual makes a request electronically, you should provide the information in a commonly used electronic format, unless the individual requests otherwise.
If you require any assistance in making a Subject Access Request please contact the surgery. Further information can be found on the Information Commissioners Office website:
Hailsham Medical Group Policy: Subject Access Request Policy, including application form