Residents' rights and subject access requests

Data protection law gives people rights over their personal data. Frontline care staff do not usually handle formal data rights responses, but they must recognise requests and pass them on without delay. A request does not need to mention "UK GDPR" or use a specific form.

A subject access request, often called a SAR, is a request for access to personal data. The ICO says SARs can be made verbally or in writing. Organisations should normally respond promptly and within one month; complex cases may take longer. Staff should forward possible requests to the appropriate person the same day where possible.

What staff may hear

• "I want to see my care notes."
• "Can I have a copy of everything you hold about me?"
• "My daughter wants the incident report from last week."
• "I think my record is wrong. Can you change it?"
• "Who has been looking at my records?"

These phrases can indicate a SAR, a request for rectification, a complaint, or a safeguarding or legal issue. Staff should not dismiss requests, promise immediate release, photocopy records informally, alter records without process, or hand information to someone else without checking authority.

Care records may contain other people's information

Care records often include details about relatives, other residents, staff, professionals, safeguarding concerns, and third-party observations. That does not remove the resident's rights, but it means disclosure may need careful review. Requests should go through the organisation's SAR or information governance process.

SAR handling

A resident does not need special wording to ask for their information. If someone asks to see, copy, correct, or understand records about them, pass it on promptly.