quote HEE facebook linkedin twitter bracketDetail search file-download keyboard-arrow-down keyboard-arrow-right close event-note

Subject Access Requests under the Data Protection Act 1998

If you want to ask us for information which we may hold about you personally then this will be dealt with under the Subject Access Provisions of the Data Protection Act 1998 (DPA). Subject access is one of the main components of the Data Protection Act.


It gives people the right to request access to their personal information. This would include information relating to employment and training records or anything which is limited to you as a person, employee or partner of any kind. For example you might want to obtain:

  • Interview feedback
  • Reference Requests
  • Score sheets
  • Additional Commentary relating to yourself; or
  • Any other personal information we might hold relating to you

Please specify the kind of information you wish to be made available to you and any time frames involved and ensure that you include proof of identity and the £10.00 fee, where you have been advised that this is required by the relevant local team. If you are unsure, please contact your local team prior to submitting your request to us.

Section 7 (3) of the FOIA states that where a data controller ‘reasonably requires’ further information to enable him to identify the individual and locate the information sought, and he has informed the data subject of this requirement then he is not obliged to comply with the request until the further information has been received.

As the data controller, HEE should be sure that the request is actually from the data subject concerned. The Information Commissioner suggests that where unintentional disclosure of information to a third party would not cause damage or distress to the data subject then a data controller can rely upon the usual signature of the data subject as proof of identity. However, where such disclosure would cause damage or distress to the real data subject then it would be reasonable for the data controller to take further steps to identify the individual making the request.

Proof of identity will usually consist of a copy of a formal document or bill with your name and address on it or your driving licence or passport.

In order to process your request quickly and efficiently we will need as much information as possible to help with responding to your request. If the information that you require relates to an interview, we will need to know:

  • The date of your interview
  • The location of your interview
  • What your interview was for
  • Type of information you are requesting

If your request relates to other personal information, HEE may reasonably require further information from you in order to locate the information you are seeking. This means that where there are very general and wide requests for data it may be reasonable for HEE to ask you for some further information to enable the data to be located. For example, if a request is made for ‘all information relating to myself’ it may be reasonable to require details of a specific time period or if this in relation to a specific incident, project or other issue to enable those records to be located.

Failure to provide this additional data might result in a delay with processing your request.

Under the DPA we have 40 calendar days to provide the information you ask for.  Please note though, that we are unable to begin processing your request until the fee and proof of ID are received.

However, where an exemption is available under the DPA, HEE might not provide you with the information covered by the exemption. It is also the case that HEE will not have to provide you with any information that might identify any other individual unless that person agrees.

If you are unhappy with any aspect of the way in which we deal with your Subject Access Request, you may complain in writing to the Information Commissioner at:

The Office of the Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

If you wish to make a Subject Access Request please email your request through to hee.dpa@nhs.net.

If you found this content useful you can share it on your favourite social network:

Or just grab the url to share wherever you like: