Subject Access Request to NHS England

NHS England is probably not the organisation holding your health records, and it says so plainly: "A request for information from medical records has to be made with the organisation that holds your records – the data controller. For example, your GP practice, optician or dentist." For hospital records it asks you to contact the records manager or patient services manager at the relevant trust. If that is what you are after, start at how to get your medical records or the NHS directory instead. There are two cases where it is the controller, and they are narrow: "NHS England is only the data controller for GP medical records where an individual is currently not registered with a GP, or is deceased and the practice they were last registered with is now closed." Those records are held by Primary Care Support England on its behalf, and NHS England asks you to make the request through the PCSE website rather than to NHS England directly. PCSE puts the same limit the other way round: if you are registered with a GP practice, you go to the practice. Records of someone who has died are not a subject access request at all — data protection rights end at death. NHS England asks you to contact the person's last registered GP practice, and PCSE takes these only where that practice has since closed. For NHS England's own records, it says requests may be made in writing, by email, or by speaking to it, and points at its Customer Contact Centre for the details. Its Data Protection Officer, at 7 and 8 Wellington Place in Leeds, is the contact for questions, concerns and complaints about how it uses information rather than for making the request. NHS England publishes no response time of its own. One caution about the telephone. The 0300 311 22 33 line is the Customer Contact Centre's general enquiries number for primary care services, and NHS England's own pages give it two different sets of opening hours. Writing or emailing gives you a record of the date, which is what the one-month clock runs from.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.