SARs, rights requests, and disclosure governance

People have rights over their personal data. In care homes, subject access requests may come from residents, relatives, attorneys, deputies, solicitors, advocates, former or current staff, complainants, and sometimes third-party portals. Requests can be verbal or written and do not need to use the words "subject access request".

ICO guidance says individuals have the right to access and receive a copy of their personal data and certain supplementary information. Organisations should normally respond without delay and within one month; complex requests or multiple requests from the same person may justify an extension. Managers need a process that begins at first contact, not only when the request reaches head office.

A safer SAR workflow

• Recognise: train staff to spot requests such as "I want my notes" or "Send me everything you hold about Mum".
• Record: log date received, requester, what was asked for, how it was received, and who is handling it.
• Verify: check identity and authority where needed, especially for relatives, attorneys, deputies, solicitors, and representatives.
• Clarify: ask proportionate clarification if the request is broad or unclear, without creating unnecessary delay.
• Search: include care records, paper files, emails, incident reports, complaints, messages, CCTV where relevant, and archived material.
• Review: consider third-party information, safeguarding risk, legal exemptions, professional opinions, and social work or health-record considerations.
• Disclose securely: use an appropriate format and secure method, with a record of what was provided and when.

Care-home complications

Care records often include material about other residents, staff, relatives, safeguarding concerns, professional opinions, and family conflict. A resident's right of access is important, but disclosure may require careful redaction or withholding where another person's rights or safety would be affected.

Requests from relatives require authority checks. A "next of kin" label does not automatically give someone the right to receive records. Relevant factors include health and welfare attorneyship, deputyship, resident consent, best interests decisions, safeguarding concerns, and the home’s local policy.

Complaints and data protection complaints

A request for records should trigger a process, not a favour. Recognise SARs early, check authority, review third-party information, and disclose securely.