Data subject access requests

Accessing your information

Under the General Data Protection Regulations, living individuals have a number of rights relating to the personal information that organisations hold about them. One of these is the right to view or obtain copies of the information that we hold about you, including your medical records. This is known as a data subject access request or DSAR.

DSARs can be made verbally or in writing and although you do not have to complete our application form, we would ask you to read it so that you can see the information we need in order to handle your request efficiently.

To be valid, your request/completed application form must include the necessary evidence of your identity, so that we can be sure that you are entitled to receive the requested information.

If you are applying on someone else’s behalf, we will also need evidence of their consent. Alternatively, you may have a legal right to represent a patient, for example, where they are unable to manage their own affairs and you have a Lasting Power of Attorney (Health and Welfare); or, in the case of a young child, you have parental responsibility.

Accessing a deceased patient’s health/medical record

Access to a deceased patient’s medical records can be given only to:

  • The patient’s personal representative (this will be the executor of the will or the administrator of the estate)
  • Any person who may have a claim arising out of the patient’s death

Alliance for Better Care has a duty to maintain the confidentiality of all medical records and this duty persists even after death. Next of kin and close relatives of the deceased do not have automatic right of access to patient records unless they are either the personal representative of the patient or have a claim arising out of the patient’s death.

You can read more about the process and the evidence of identity required in our patient leaflet or application form.

Download patient leaflet

Making your request

If you would like to access our application form, please contact our Quality team:


In accordance with the Department of Health guidance to NHS organisations, we will always try to provide information within 21 calendar days if it is at all possible to do so. However, the General Data Protection Regulations allows us a legal timescale of one month to respond. The month starts when we receive your request together with all the required supporting information.

Please make sure that you describe clearly the information you would like to receive as we may otherwise have to contact you for clarification, which would delay your request.