Policies & Procedures
Subject Access Request Procedure v1.0
Document owner | Registered Manager / Director |
Approved by | Mrs. Tavleen Sharma (Registered Manager) |
Version | 1.0 |
Review frequency | Every 12 months or following any significant incident |
Next review date | 12 months from issue or earlier if required. Next formal review date: 01-04-2027 |
1. Purpose
VCare Consultancy Services Limited is committed to ensuring that individuals are able to exercise their rights under UK GDPR and the Data Protection Act 2018, including the right to access personal information held about them.
This procedure sets out how VCare Consultancy Services Limited manages Subject Access Requests (SARs) to ensure requests are handled lawfully, securely, fairly and within statutory timescales.
This procedure supports compliance with:
- UK GDPR;
- Data Protection Act 2018;
- Human Rights Act 1998;
- Care Act 2014;
- Health and Social Care Act 2008;
- CQC Fundamental Standards;
- NHS Data Security and Protection Toolkit requirements.
2. Scope
This procedure applies to all requests for personal information held by VCare Consultancy Services Limited relating to:
- service users;
- staff;
- relatives;
- applicants;
- contractors;
- third parties.
It applies to:
- electronic records;
- paper records;
- emails;
- care records;
- personnel records;
- incident reports;
- CCTV footage where applicable;
- communication records.
3. Definition of a Subject Access Request
A Subject Access Request is a request made by an individual seeking access to personal information held about them.
Requests may be made:
- verbally;
- in writing;
- by email;
- by letter;
- by electronic communication.
A request does not need to mention “Subject Access Request” or UK GDPR to be valid.
4. Rights of Individuals
Individuals have the right to:
- obtain confirmation whether their data is being processed;
- access their personal information;
- receive supplementary information regarding processing activities;
- receive copies of their personal information where appropriate.
5. Responsibility
The Registered Manager and senior management team are responsible for:
- overseeing SAR compliance;
- ensuring requests are handled appropriately;
- monitoring timescales;
- ensuring secure disclosure of information.
All staff must:
- recognise SARs;
- report requests immediately to management;
- cooperate with retrieval of information;
- maintain confidentiality.
6. Receiving a Request
Upon receipt of a SAR:
- The request must be logged immediately.
- The date of receipt must be recorded.
- The requester’s identity must be verified where necessary.
- Clarification may be requested if the request is unclear or excessive.
The statutory response timeframe begins once sufficient information has been received to identify the requester and process the request.
7. Verification of Identity
VCare Consultancy Services Limited may request proof of identity before releasing information.
Acceptable forms of identification may include:
- passport;
- driving licence;
- utility bill;
- official correspondence.
Information will not be disclosed until identity is satisfactorily verified.
8. Requests Made on Behalf of Another Person
Requests made by:
- solicitors;
- family members;
- advocates;
- representatives;
must include evidence of authority to act on behalf of the individual where appropriate.
Additional consideration will be given to:
- mental capacity;
- safeguarding;
- confidentiality;
- best interests.
9. Timescales
VCare Consultancy Services Limited will normally respond within one calendar month of receipt of a valid request.
Where requests are:
- complex; or
- numerous;
the response period may be extended by up to two additional months where legally permitted.
The requester will be informed if an extension is required.
10. Locating Information
Relevant records will be identified and reviewed including:
- care records;
- assessments;
- communication records;
- staff records;
- incident reports;
- emails;
- electronic systems;
- archived records where applicable.
Only information relevant to the requester will be disclosed.
11. Reviewing and Redacting Information
Information will be reviewed before disclosure to:
- protect third-party confidentiality;
- ensure safeguarding considerations are addressed;
- remove legally exempt information where applicable;
- ensure information is accurate and appropriate for disclosure.
Information may be withheld where exemptions apply under data protection legislation.
Examples may include:
- safeguarding concerns;
- legal privilege;
- management forecasting;
- third-party confidentiality;
- crime prevention or detection.
12. Format of Disclosure
Information may be provided:
- electronically;
- by secure email;
- by printed copies;
- through secure collection arrangements.
Information will be supplied securely and in an accessible format where reasonably practicable.
13. Fees
Subject Access Requests are normally provided free of charge.
A reasonable fee may be charged where requests are:
- manifestly unfounded;
- excessive; or
- repetitive,
in accordance with UK GDPR provisions.
14. Refusal of Requests
VCare Consultancy Services Limited may refuse or restrict requests where lawful exemptions apply.
Any refusal will:
- be explained in writing;
- include reasons where appropriate;
- advise the individual of their right to complain to the ICO.
15. Record Keeping
A SAR log will be maintained including:
- date received;
- requester details;
- nature of request;
- actions taken;
- dates responded;
- information disclosed;
- any exemptions applied.
Records will be retained securely.
16. Confidentiality and Security
All SAR-related information must be handled securely and confidentially.
Information must:
- only be accessed by authorised personnel;
- be securely transferred;
- not be disclosed to unauthorised individuals.
17. Complaints
Individuals dissatisfied with the handling of a request may:
- Raise concerns directly with VCare Consultancy Services Limited; and/or
- Complain to the Information Commissioner’s Office (ICO).
ICO Contact Details:
www.ico.org.uk
Telephone: 0303 123 1113
18. Training and Awareness
Staff receive training relating to:
- confidentiality;
- GDPR awareness;
- information governance;
- Subject Access Requests;
- secure handling of records.
19. Related Policies
This procedure should be read alongside:
- Privacy Notice;
- Information Security Policy;
- Data Breach Procedure;
- Confidentiality Policy;
- Records Management Policy;
- Safeguarding Policies.
20. Review
This procedure will be reviewed:
- annually;
- following legislative changes;
- following significant incidents or complaints.