GABLES MEDICAL CENTRE
SUBJECT ACCESS REQUEST

This policy should be read in conjunction with our Practice Privacy Notice which outlines how we use your information in relation to your healthcare.
The General Data Protection Regulation or GDPR (effective from 25.05.18) amends existing data protection law.  It introduces changes which give you greater control over your personal information including the right to object to processing of the same.  As data controllers, GPs have fair processing responsibilities in respect of the personal information held about patients. It is important that patients are aware of and understand the changes GDPR introduces.  Dr Russell is the Practice Data Protection Officer.
Under GDPR you have enhanced rights in relation to how your information is used and accessed.  You have:
•	the right to view/obtain details of the personal information we hold about you free of charge by making a subject access request (SAR) in accordance with GDPR. 
•	the right to have your personal information amended/rectified if it is inaccurate or incomplete
•	the right in certain circumstances to restrict or withdraw consent
The Practice:
1.	will endeavour to provide information in the format requested.  However it is the duty of the Data Controller (ie the Practice) to redact third party data before supplying access to or a copy of information.
2.	will provide this within 1 calendar month; however if the request is complex we may extend the response timeframe by a further 2 months – this would be in consultation with you the patient/applicant so you are aware within the first month that we need more time and why. 
3.	may only charge a reasonable fee where the request is manifestly unfounded or excessive.
If you wish to make a subject access request or exercise any of your data rights, it is practice policy to contact the Practice Manager in writing.

May 2018