Subject Access Requests

Which Sections Of A Subject Access Request Form Should I Complete?

Sections 1, 2, 3, and 4 should be completed for all applications.

Sections 5 and 6 (Representative Details and Authority to Release Information to a Representative) should only be completed if the application is being made by a representative (i.e. someone other than the data subject themselves).

Section 3 (Proof of the applicant’s identity) – If you do not have any of the forms of identity listed, we may in exceptional circumstances accept alternatives for consideration.

What Information Does Bruntsfield Medical Practice hold?

Bruntsfield Medical Practice holds information relevant to its functions which will include, but is not restricted to personal data obtained in the process of discharging its functions as a Medical Practice, an employer and a business; however, some data may have been reviewed and destroyed where appropriate in accordance with our own or other partner organisations information retention policies.
Bruntsfield Medical Practice has a lawful duty to hold personal data which is necessary for the provision of:

Health or social care medical diagnosis or treatment or the management of health or social care systems;
Preventative or occupational medicine for assessing the working capacity of an employee;
Providing employment.

How long will it take to get my data?

Once we are satisfied that you meet the criteria for disclosure of data under the Data Protection Act and have provided sufficient information, you should receive a response within one calendar month from the date that we accept your application for processing.

Records may be held in other locations in both paper and electronic formats. If you only require specific information and you clearly state what that is – for example a specific document or IT-only data – then you are likely to achieve a quicker disclosure.

The form includes a section for giving details if you need a disclosure by a certain date. No guarantee can be given that a disclosure will be completed by that date but we will endeavour to comply with reasonable requests for expedited action.

General Notes

We will acknowledge your application in writing.
When we process information requests for children aged 12 or over and spouses, we require their signature of authority before disclosing data. A separate application form should be completed for each individual. Sections, 3 and 4 should be completed by a parent/guardian for a child under 12.
The documents that you receive may have data redacted (blacked-out) or contain rough notes that may lack clarity. This is because we aim to supply copies of the original records whenever possible; however, as medical records may also include third party information that we cannot release to you under the Data Protection Act, e.g. another person’s data, this is removed.
We will not disclose information by fax or telephone. Disclosure by post is usually made by second class post to the address you provide in section 2 or, if appropriate, to your representative named in section 5.

Checklist

Have you completed all relevant sections of the form?
If you are a representative, has your client signed the authority in Section 7 or provided a separate signed note of authority?
If you are submitting the form yourself, have you signed the form at Section 4?
If you are signing as a parent or guardian of a child under 12, have you provided a photocopy of their full birth certificate, photocopies of any court orders and proof of your parental responsibility?
Have you enclosed two pieces of identification from the lists in Section 2 (one from each of A and B)?
Have you signed the declaration in Section 4?
Have you provided as much information as possible to enable us to find the data you require?