All guides / Your own data

Request your own data from the hospital

This is not the request for your relative's records. This is a request for the data the hospital holds about you, and it can be revealing.

What is this?

A Subject Access Request (SAR) is your right under Article 15 of the UK GDPR to obtain a copy of the personal data an organisation holds about you. It is different from the Access to Health Records Act request for your deceased relative's records. That request is about them. This one is about you: everything the hospital has recorded about its dealings with you since the death.

What counts as your data

More than people expect. If it identifies you or is about you, it is your personal data, including:

• Internal emails that mention you
• Recordings of phone calls you made
• Notes of conversations and meetings with you
• Records of the complaints you have made
• Minutes of meetings that discuss you or your case
• Decision logs about how to handle you or your requests

Why it matters

The records a body keeps about how it manages you often tell a different story from the records about your relative's care. A SAR can reveal internal coordination, policy decisions that shaped what you were allowed to see, and, on occasion, evidence of obstruction. Where you have been stonewalled, the SAR is how you find out who decided that, and why.

Who can use it?

Anyone, for their own data. You are the data subject, so you have the right. No solicitor, no qualifying status, no fee.

Step by step: how to make the request

1. Address it to the Data Protection Officer. Send your SAR to the hospital's or board's Data Protection Officer (DPO) or Information Governance team. You will find the contact for every Scottish board on one page: see Scottish NHS board records contacts.
2. State it is a SAR under Article 15. Make clear you are exercising your right of access under Article 15 of the UK GDPR.
3. Help them identify you. Give your full name, address and date of birth, and offer to verify your identity.
4. Specify the period. For example, from the date of death to the present.
5. Specify the departments. Name where your data is likely to sit: complaints, legal, information governance, health records, and the relevant wards.
6. Ask for the categories above by name. Listing emails, call recordings, meeting minutes and decision logs makes it harder to overlook them.
7. Keep a dated copy and proof of sending.

What it costs

There is no fee for a Subject Access Request in all but exceptional cases.

What happens next

• They must respond within one calendar month of receiving the request.
• They can extend by a further two months if the request is complex, but they must tell you within the first month that they are doing so, and why.
• If they miss the deadline, or refuse without a proper basis, you can escalate to the ICO. See how to complain to the ICO.

[Your full name]
[Your address]
[Your email and telephone]
[Your date of birth]
[Date]

The Data Protection Officer
[Name of NHS board]
[Address]

Dear Data Protection Officer

Subject Access Request under Article 15 of the UK GDPR

I am making a request for access to my personal data under Article 15 of
the UK GDPR. I am the data subject. My details for identification are above,
and I am happy to provide further verification of my identity if required.

Please provide a copy of all personal data you hold about me, together with
the supplementary information required under Article 15 (including the
purposes of processing, the recipients, the retention period, and the source
of the data where it was not collected from me).

Period: please include data from [date of death] to the date of this request.

Departments: please search at least the following, where my data is likely
to be held:
- Complaints / feedback
- Legal / legal aspects
- Information governance / records management
- Health records
- The relevant ward(s) and clinical teams: [specify if known]

Categories: for the avoidance of doubt, my personal data includes, but is
not limited to:
- internal emails that mention me
- recordings or transcripts of telephone calls I made
- notes of conversations or meetings involving me
- records of complaints I have made
- minutes of meetings that discuss me or my case
- decision logs or case-handling notes concerning me or my requests

I understand that no fee is payable and that you must respond within one
calendar month of receiving this request. If you consider the request
complex and intend to extend the period, please tell me within the first
month, together with your reasons.

Please provide the response in electronic form where possible.

Yours faithfully

[Your name]