Your GP surgery and every NHS service you’ve ever used holds a written history of your health — and under UK law, that record belongs to you as much as it belongs to them. If you want to see it, correct it, or simply confirm what’s written about you, you don’t need permission from a doctor. You need a Subject Access Request, and knowing how the process actually works is the difference between a straightforward one-month wait and a frustrating chase for information you’re legally entitled to.
What a Subject Access Request Actually Is
A Subject Access Request, or SAR, is the formal mechanism created by UK GDPR and the Data Protection Act 2018 that lets any individual ask an organisation holding their personal data — including a GP practice, hospital trust, dentist or optician — for a copy of it. Health records fall squarely within this right. Crucially, you do not have to explain why you want your records. You might be switching GP practices, preparing for a legal claim, querying a diagnosis, or simply exercising the basic consumer right to know what’s held about you. None of that needs justifying to the organisation you’re asking.
It’s worth being clear-eyed about one structural quirk: NHS medical records are not held in a single national file. Your GP, your local hospital, your dentist and any specialist clinic each keep their own separate record, and a SAR only reaches the organisation you send it to. If you want your full history, you may need to send more than one request.
How to Make the Request — and What to Include
A SAR can be made verbally, by email, by letter, or even through a practice’s online contact form — there’s no mandatory format. In practice, a written request is easier for both sides to track, and using the phrase "Subject Access Request under the UK GDPR" in your message removes any ambiguity about what you’re asking for.
- Address it to the practice manager or the organisation’s data protection lead, not just a general enquiries inbox.
- Include your full name, date of birth, NHS number if you have it, and current address.
- State clearly whether you want your entire record or specific entries, date ranges or topics — a narrower request is often processed faster.
- Specify a preferred format: a digital copy, printed copy, or read-only access.
- Be ready to prove your identity. A reasonable ID check is standard, but the process shouldn’t be made needlessly difficult.
One practical shortcut worth knowing: many patients in England can already view GP record entries made from November 2022 onward instantly through the NHS App, without a formal SAR at all. For anything older, or for a hospital, dental or optical record, a written request to that specific provider is still the route.
The Timeframe: One Month, With a Possible Extension
Once your request and identity are confirmed, the organisation has to respond "without undue delay" and, at the very latest, within one calendar month. That deadline can be extended by up to two further months if the request is genuinely complex or you’ve made several requests at once — but the provider must tell you about the extension, and why, within that first month. Silence past the one-month mark, with no explanation, is itself a breach of your rights, not just a delay.
| Element | What applies |
|---|---|
| Legal basis | UK GDPR and the Data Protection Act 2018 |
| Standard response time | One calendar month from a complete request |
| Possible extension | Up to two further months, for complex requests, with notice given |
| Typical cost | Free in almost all circumstances |
| Enforcement body | The Information Commissioner’s Office (ICO) |
Is There a Fee? What You Can and Can’t Be Charged For
In the overwhelming majority of cases, a Subject Access Request for your medical records is free. A healthcare provider can only charge a "reasonable" administrative fee in two narrow situations: if your request is manifestly unfounded or excessive, or if you’re asking for further copies of information you’ve already been given. There’s no general right for a GP practice or trust to charge a standard fee simply for processing a first, straightforward request — if you’re quoted one without either of those justifications, it’s worth questioning.
What to Do If You’re Refused or Ignored
If a provider misses the deadline, refuses outright, or hands over an incomplete record without explanation, the first step is internal: raise it with the practice manager, the organisation’s data protection officer, or its formal complaints process, in writing, referencing your original request date. Most delays get resolved at this stage once there’s a paper trail.
If that doesn’t work, the next step is the Information Commissioner’s Office, the independent regulator responsible for enforcing UK GDPR across every sector, including the NHS and private healthcare providers. The ICO can investigate a complaint, compel an organisation to release the records it’s withholding, and has the power to issue fines for serious or repeated breaches of data protection law. Reporting a mishandled SAR to the ICO costs you nothing and doesn’t require a solicitor — it’s the same consumer-protection safety net that exists behind any other UK GDPR right.
The Bottom Line
The right to see your own medical records isn’t a favour a practice grants you — it’s a legal entitlement with a fixed timetable, almost no cost, and a regulator standing behind it if things go wrong. Whether you’re checking a historic diagnosis, gathering evidence for a claim, or simply want to know what’s written in your file, a clearly worded Subject Access Request, sent to the right organisation with the right details, is usually all it takes to get your answer within a month.