Parliamentary Search

Written question asked by Ben Maguire (Liberal Democrat) on Monday, 5 January 2026, in the House of Commons. It was due for an answer on Wednesday, 7 January 2026. It was answered by Ian Murray (Labour) on Tuesday, 13 January 2026 on behalf of the Department for Science, Innovation and Technology.

NHS Trusts: Subject Access Requests

Question

To ask the Secretary of State for Science, Innovation and Technology, if she will made an assessment of the potential impact of SARs not being disclosed by NHS hospital trusts within the statutory one month timeframe.

Answer

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) provide individuals with the right to access their personal data, subject to relevant exemptions. A subject access request must be responded to within one month of receiving the request. The response time may be extended by a further two months if the request is complex, or if the individual has submitted a number of requests, provided the organisation informs the requestor within the one-month period and provides reasons for the delay.

NHS England has produced guidance for patients and service users on making a Subject Access Request (SAR), and for professionals to ensure they can respond to requests in a timely manner. It can be found here: https://transform.england.nhs.uk/information-governance/guidance/subject-access-requests/

The Information Commissioner’s Office (ICO) is responsible for monitoring and enforcing the data protection legislation independently of government, and is accountable to Parliament.

Secondary information

Type
Written question
Reference
103138
Session
2024-26
Subjects
Disclosure of information NHS trusts Subject access requests
Link
View this Written question on www.parliament.uk