A Subject Access Request (SAR), also known as a Data Subject Access Request (DSAR), is an individual's legal right to obtain a copy of their personal data. For care homes, this typically means requests for care records, medication records, incident reports, and other documentation.
Under UK GDPR Article 15, individuals have the right to access their personal data free of charge, and organisations must respond within one calendar month.
Response Timeline
Key Deadline
You must respond to a SAR within one calendar month of receiving the request. The clock starts from the day you receive the request, whether by email, letter, or verbal.
The timeline can be extended in specific circumstances:
- Complex or numerous requests: Can extend by up to two additional months, but you must inform the requester within the first month and explain why
- Identity verification needed: The clock pauses until you receive satisfactory ID verification
Who Can Make a Request?
The Individual Themselves
Residents with mental capacity can request their own records directly. The request doesn't need to be in writing or use specific words—"I want a copy of my records" is sufficient.
Representatives
Third parties can make requests on behalf of residents:
- Power of Attorney (Health & Welfare): Can request records if the attorney has the legal authority and the donor lacks capacity for this decision
- Court-appointed Deputy: Similar to LPA, within their scope of authority
- Family members: Only with explicit consent from the resident (if they have capacity) or if acting as LPA/Deputy
- Solicitors: Must provide evidence of authority to act (typically a signed mandate from the client)
Verify Authority
Always verify that third parties have authority to request records. Ask for evidence of LPA registration, court order, or written consent from the data subject. The ICO can take action if you disclose to unauthorised persons.
What Must Be Provided
A complete SAR response includes:
Exemptions and Redactions
Not all information must be disclosed. You can withhold or redact information in certain circumstances:
Third Party Information
If records contain information about other individuals, you generally cannot disclose that information without their consent. This commonly applies to:
- Other residents mentioned in records
- Staff members who made entries (though job titles can usually be disclosed)
- Family members mentioned in care notes
Redact third party information before disclosure.
Serious Harm Exemption
Under the Data Protection Act 2018, you can withhold information if disclosure would be likely to cause serious harm to the physical or mental health of the data subject or another person. This is a high threshold and requires careful consideration.
Legal Professional Privilege
Information subject to legal professional privilege (e.g., correspondence with solicitors about potential litigation) is exempt.
Confidential References
Employment references given in confidence are exempt from SAR disclosure.
Step-by-Step Process
Recognise the Request
A SAR doesn't need to mention "GDPR" or "subject access." Any request for personal data is a SAR. Train staff to recognise and escalate requests.
Log and Acknowledge
Record the date received (this starts the clock). Send an acknowledgment confirming receipt and expected response date.
Verify Identity
If you have reasonable doubts about identity, request verification. For third parties, verify their authority. Don't ask for more ID than necessary.
Locate the Data
Search all systems: digital care records, paper files, emails, CCTV (if applicable). Include archived records.
Review and Redact
Review records for exemptions. Redact third party information. Document your decisions and reasoning.
Prepare Response
Compile the data in a clear format. Include a covering letter explaining any exemptions applied and their rights.
Deliver Securely
Send via secure method: encrypted email, registered post, or collection in person with ID check. Keep proof of delivery.
Common Mistakes to Avoid
- Missing the deadline: One month is strict. Diarise it immediately on receipt.
- Charging a fee: SARs are free under UK GDPR. You can only charge for manifestly unfounded or excessive requests.
- Over-redacting: You cannot refuse to disclose just because information is "sensitive"—only specific exemptions apply.
- Disclosing to wrong person: Always verify identity and authority before disclosure.
- Not searching everywhere: Include emails, archived files, and any other location where personal data may be held.
Key Takeaway
Subject Access Requests are a legal right that must be taken seriously. The key is having a process: recognise requests quickly, log them immediately, verify identity, locate all relevant data, apply exemptions correctly, and respond within one month. Most care homes receive few SARs, but when you do, getting it right matters.
Sources and Further Reading
SAR-Ready Records
Revitaco makes SAR responses easier with searchable records, one-click exports, and built-in audit trails.
Book a Demo