Subject Access Request to the British Medical Association

The BMA publishes one subject access route and it is on one page. Its privacy policy names dpo@bma.org.uk for making a request; its contact us page lists six other mailboxes and does not mention that one. There is no online form and no portal. To exercise any of the rights in the policy by post, the BMA gives the Records Officer in its Technology Services Department at BMA House, which is the address published here. Say which BMA file you mean. The policy separates membership data from "case related data — includes information you give us about an employment or pensions related enquiry for which you seek our support and assistance", so quoting your BMA ID and the dates of the advice or case is worth more than asking for everything. The BMA is not your regulator. Fitness-to-practise, registration and revalidation records are the General Medical Council's, and getting those is a separate request to a different organisation. Your NHS or practice personnel file belongs to your employer — see making a request to your employer — and your own health records belong to your GP practice or hospital, covered on our medical records page. Two things a member would not guess. BMA counselling is delivered by an outside firm: "Our counselling service is provided through our accredited provider Health Assured", on a number the BMA says "is external to the BMA", so ask where those notes are held rather than assuming they are in your BMA file. And peer support data "will be held for up to 20 years". Other companies may hold part of it. The BMA says it may share data with "other companies in the BMA Group acting as controllers, joint controllers or processors … (such as the BMJ)", and names that group as the British Medical Association, BMJ Publishing Group, BMA Investments Limited and BMA Law Limited. Affinity partners providing member benefits can be "controllers in their own right", so a benefit bought through one of them may need its own request to that company. The DPO also publishes a telephone number, 020 3058 7415, for questions about how the BMA uses your information. The privacy policy names only the email address for making the request itself.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.