You ask for your records because something about your care doesn't add up. Appointments were rushed. Symptoms were brushed off. A referral never happened, or happened far later than it should have. You know you need the paper trail, but you're worried the practice will stall, fob you off, or hand over only part of the story.
That's exactly why a subject access request to a GP matters. It isn't just an admin formality. It's often the first solid step in building a documented case, whether you're preparing for a specialist appointment, checking what was written in your notes, or laying the groundwork for a complaint.
If you expect resistance, your strategy matters as much as your wording. Verbal requests can work. Informal chasing can work. But when a patient is already being ignored, a dated written request, clear scope, and careful follow-up usually work better because they create evidence.
Table of Contents
- Your Right to Access Your Full GP Medical Record
- How to Draft and Send Your SAR to Your GP
- What to Expect After You Submit Your Request
- Understanding Redactions and Withheld Information
- How to Complain if Your GP Refuses or Ignores You
- Frequently Asked Questions About GP SARs
Your Right to Access Your Full GP Medical Record
A subject access request, usually shortened to SAR, is your legal right to ask for the personal data a GP practice holds about you. In plain English, it's the mechanism that lets you obtain your own medical record instead of relying on a summary screen, a receptionist's interpretation, or memory after a difficult appointment.
Under UK GDPR and the Data Protection Act 2018, you don't have to give a reason, the request is usually free of charge, and the practice should provide the information in your preferred format where possible. Refusal is limited to rare situations, such as where disclosure is likely to cause serious harm, as outlined in this GP SAR guidance from DCS Legal.
What a SAR actually is
Patients often underestimate this. They think they're asking for “a copy of what's on the system”. In reality, a well-made SAR asks for the full personal data set the practice holds within scope.
That matters because the NHS App may show useful fragments, but it often isn't the whole record. If you're trying to understand a missed diagnosis, a refused referral, coded symptoms, medication history, or whether concerns were recorded accurately, a partial view won't do.
Practical rule: If you may need to challenge care later, ask for the full GP record unless you have a strong reason to narrow the scope.
If you want extra support on the practicalities of obtaining your notes, this guide to medical records access is a useful companion.
What your full GP record can include
A full disclosure can include a wide range of material, depending on what the practice holds and the scope of your request. That may include:
- Consultation entries such as appointment notes, symptom descriptions, clinician observations, and follow-up plans.
- Test information including blood test results, other investigation results, and comments attached to them.
- Medication history such as prescriptions issued, stopped medicines, and review notes.
- Referral material including referral letters sent to hospitals, clinics, or community services.
- Incoming correspondence such as letters back from specialists, discharge summaries, and other communications received by the practice.
- Administrative entries including some internal handling notes connected to your care.
If your aim is to build a complaint or correct the record, these details are often where the important issues sit. A patient may discover that symptoms were coded differently from how they were described, that a referral was considered but not sent, or that a letter from secondary care never led to the follow-up they expected.
That's why a subject access request to a GP is often the foundation document. Before you argue about what should have happened, you need to know what the record says did happen.
How to Draft and Send Your SAR to Your GP
If you expect pushback, keep your request simple, formal, and easy to process. Don't send a long emotional history. Don't mix your SAR with a complaint about your care. Those are separate tracks, and combining them often slows both down.
NHS England and Patient.info note that GP practices can receive SARs in writing, by email, or verbally, and practices commonly handle them by logging the request, confirming identity, collecting the relevant records, redacting third-party data, and sending the response securely, as described in this SAR handling overview for GP practices.
Why written requests work better
A verbal request is legally valid. Strategically, though, a written request is usually stronger.
A written SAR gives you a date, wording, and proof of what you asked for. If the practice later says it didn't understand, didn't receive, or thought you wanted something narrower, you've already protected yourself. Email is often the easiest route because it creates a timestamp automatically.
Use these basics:
- State the legal basis clearly so there's no room for confusion. Say you are making a subject access request under UK GDPR.
- Identify yourself cleanly with your full name, date of birth, address, and NHS number if you know it.
- Define the scope by asking for your full GP medical record, or by specifying a date range if you only need part of it.
- Ask for a usable format such as electronic copies by secure email, if that works for you.
- Keep evidence by saving the sent email, attachments, and any acknowledgement.
Ask for “my full GP medical record, including consultation notes, test results, referral letters, and incoming correspondence” if you want to avoid a narrowed interpretation.
A copy and paste SAR template
You can adapt this and send it by email or letter.
Dear Practice Manager,
I am making a subject access request for my personal data held by the practice under UK GDPR.
Please provide a copy of my full GP medical record. This should include consultation notes, coded entries, test results, medication history, referral letters, and correspondence received or sent in relation to my care.
My details are:
Full name:
Date of birth:
Address:
NHS number (if known):I would like the information in electronic format, sent securely by email if possible.
I attach proof of identity. If you need anything further to process this request, please let me know promptly in writing.
Yours faithfully,
[Your name]
[Date]
If you're posting it, sign and date the letter and keep a copy. If you're emailing it, attach the same text as a PDF as well as placing it in the email body. That gives you a cleaner record later.
What proof of identity is usually reasonable
Practices do need to confirm identity before releasing records. That's sensible. Your medical file is sensitive, and staff shouldn't hand it to the wrong person.
What's usually reasonable depends on the circumstances, but many patients can satisfy this with standard identification documents. Common examples include a copy of a passport or driving licence, sometimes supported by proof of address if needed. If the practice already knows you well, the process may be more straightforward.
What doesn't work well is an open-ended back-and-forth where the practice keeps asking for more without explaining why. If that happens, respond in writing and ask them to confirm exactly what is missing and why it is necessary to verify identity for this request.
If you want a structured option beyond drafting your own letter, Finally Seen Ltd provides personalised formal letters and complaints packs for patients who need a documented paper trail with their GP. For many people, though, the template above is enough if they send it clearly and keep records.
What to Expect After You Submit Your Request
Once your request is in, switch from asking to tracking. Many patients lose momentum at this stage. They assume the practice will deal with it. Sometimes it does. Sometimes the request drifts between inboxes, sits pending for identity checks, or gets treated like a low-priority admin task.
The formal rule matters here. The standard deadline is one calendar month from receipt of the request and confirmed identity, and the old 40-day system no longer applies. For complex requests, the practice can extend by up to two further months, but it must tell you within the first month and explain why, as set out in NHS England's subject access request guidance.
How the timeline usually works in practice
The key phrase is one calendar month. That isn't the same as waiting for a convenient admin slot, and it doesn't mean the practice can leave the request untouched until you chase.
Some practice policies describe timing as 30 days or 28 days depending on how they count and when missing information is supplied, while Patient.info notes that the one-month deadline includes weekends and holidays, according to this example GP SAR policy.
A realistic example helps. If you email your SAR on the fifth of the month and attach enough ID, the response is generally due one calendar month later. If the practice replies asking for proof of identity and you only provide it later, the practical dispute often becomes when the request became valid. That's one reason it's better to include ID at the start.
What the practice is doing behind the scenes
A competent practice process usually looks something like this:
| Stage | What usually happens |
|---|---|
| Request logged | The practice records the date and basic details of your SAR |
| Identity checked | Staff confirm they can safely release the information to you |
| Records gathered | Relevant notes and documents are pulled from the system |
| Redactions made | Third-party details or restricted material may be removed |
| Response sent | Records are issued securely, often electronically |
This is routine work for practices. It isn't a special favour. But routine doesn't always mean smooth. Delays often happen when a request is vague, ID is missing, staff are unsure whether you want a summary or the full record, or the request lands with someone who doesn't recognise it as a formal SAR.
If the first month passes without records or a valid extension notice, stop making informal phone calls and move to a dated written follow-up.
That follow-up should be short. Confirm the date of your original request, attach it again, note that the deadline has passed, and ask for an immediate response. This process ensures your paper trail starts doing real work.
Understanding Redactions and Withheld Information
Patients are often alarmed when records arrive with blacked-out sections or gaps. Sometimes that concern is justified. Sometimes the redactions are lawful and expected. The important question isn't “Has anything been removed?” but “Was there a proper reason?”
The two most common reasons are protection of third-party information and concerns about serious harm. Neither is a general escape hatch.
Third-party information
Your GP notes may mention other identifiable people. That could be a relative, partner, carer, or someone who gave information to the practice. If disclosing that part of the record would reveal another person's personal data, the practice may need to redact it.
This doesn't usually justify withholding your whole record. It usually means limited editing of the affected passages.
Examples can include:
- Relative details where a family member's health or personal circumstances are recorded in a way that identifies them.
- Named third parties such as someone who contacted the surgery and whose identity should not be disclosed automatically.
- Mixed entries where your care note includes both your information and someone else's.
Serious harm is a narrow exception
The other exception is where disclosure is likely to cause serious harm to you or another person. That threshold is high. It isn't the same as saying the information may upset you, frustrate you, or trigger disagreement.
If a practice relies on this ground, look closely at how broad the refusal is. A narrow redaction may be lawful. A blanket refusal often deserves scrutiny.
A lawful redaction should be specific and proportionate. It shouldn't swallow the whole record unless there is a genuinely exceptional reason.
If something important appears to be missing, ask the practice to clarify whether material has been withheld, on what basis, and whether the rest of the record has been disclosed in full. Keep that request factual. At this stage, you're not trying to win an argument. You're trying to make the practice commit itself to a written position.
How to Complain if Your GP Refuses or Ignores You
When a practice ignores a SAR, the temptation is to send increasingly angry emails. That usually feels justified. It often isn't effective. What works better is a disciplined escalation path, with each step creating a stronger documentary record than the last.
If your records may support a wider complaint about dismissive care, poor follow-up, or failure to act on symptoms, your handling of the SAR matters. A muddled complaint trail gives the practice room to argue about process. A clear trail narrows the dispute.
Start with a formal follow up
Your first escalation should usually stay inside the practice. Address it to the practice manager if possible. Keep the tone calm and firm.
Include:
- The original request date and attach the request again.
- Confirmation of identity evidence you already supplied.
- A short statement of the problem such as no response, incomplete response, or refusal without clear reasons.
- A clear ask for the records or a written explanation.
A short example:
I made a subject access request on [date] and supplied identification. I have not yet received my records or a valid explanation for delay. Please treat this as a formal follow-up and confirm, in writing, when my response will be provided.
If the practice has a complaints procedure, use it. Mark your email or letter clearly so it can't be dismissed as casual correspondence.
Know which route matches the problem
Patients often send everything everywhere. That's understandable, but it weakens the message. Different bodies deal with different failures.
Use this split:
| Problem | Best route |
|---|---|
| The practice ignored or mishandled your data rights | Information Commissioner's Office |
| The practice's behaviour or service standards were poor | NHS complaint route |
| The issue affects both data access and care quality | Run both routes separately with matching evidence |
The Information Commissioner's Office is the regulator for data protection issues. If a practice won't comply with a SAR, delays without explanation, or refuses access without a proper basis, that is the natural escalation route.
The NHS complaints route is different. That route addresses service failure, poor communication, unsafe handling, or the wider consequences of not giving you records. Depending on the situation, that may involve the practice first, then your local Integrated Care Board, and potentially the Parliamentary and Health Service Ombudsman if the matter remains unresolved.
If you need a practical starting point for the NHS side, this guide on how to complain about a GP is useful.
Don't bundle every grievance into one long email. Send a data-rights complaint for the SAR problem, and a service complaint for the care problem. They may overlap in facts, but they are not the same issue.
What to keep in your complaint file
A good complaint file does two jobs. It helps you remember the sequence, and it prevents the practice from rewriting it later.
Keep copies of:
- Your original SAR and any attachments
- Proof of sending such as sent email records or postal receipt
- Identity documents supplied
- Acknowledgements or replies from the practice
- A simple chronology of dates and events
- Any partial disclosure you received
- Notes of phone calls including date, time, name, and what was said
At this point, many strong cases are either built or lost. Patients often remember exactly how obstructive the practice was, but they can't prove the sequence cleanly six weeks later. Write it down as you go.
A subject access request to a GP is often the first document in a wider accountability file. If the records later show inaccurate notes, ignored symptoms, or missing follow-up, you'll already have evidence that you asked properly, waited properly, and escalated properly.
Frequently Asked Questions About GP SARs
Patients usually reach this stage with one of two worries. Either they're unsure whether they can make the request at all, or they're unsure what to do with the records once they arrive. Both matter. Access alone doesn't improve care unless you use the information carefully.
Some quick answers are below, and the Finally Seen FAQ page covers related issues in plain English.
Quick Guide to Subject Access Request Scenarios
| Scenario | Can I request? | Key Consideration |
|---|---|---|
| I want my full GP record | Yes | Ask clearly for the full record rather than a summary |
| I only need a specific period | Yes | Give dates or a defined event to narrow the search |
| I made the request by phone | Yes | Follow up in writing if you need proof and a paper trail |
| I'm requesting on behalf of someone else | Sometimes | The practice may need evidence of authority, consent, or legal standing |
| My GP practice has merged or closed | Usually | Records are often transferred, so identify the current holder of the records |
| The practice says there may be a charge | Usually no | SARs are generally free, though practical disputes can still arise |
| Part of the record is blacked out | Yes, that can happen | Ask what legal basis was used for the redaction |
A few of these deserve extra comment.
If you're acting for another adult, practices commonly want proof that you're authorised to do so. That may be consent from the patient or another recognised basis for acting on their behalf. If you're helping a child or someone who lacks capacity, the practice may look closely at whether you have the right to receive the records.
If the old practice has closed, don't assume the records are gone. They may have been transferred to a successor practice or another records holder. Start by asking whoever now manages the patient list or holds the records for that area.
If a receptionist says there is a fee, don't argue on the spot. Put your position in writing and ask the practice to confirm the basis for any charge. Written clarification is more useful than a verbal disagreement.
What to do once your records arrive
Here, the SAR becomes more than an admin success.
Don't just skim the file once and put it aside. Review it with a purpose:
- Read chronologically so you can see how symptoms, requests, and decisions unfolded over time.
- Mark factual errors such as wrong dates, missing symptoms, or consultation notes that don't reflect what was discussed.
- Identify patterns including repeated dismissal, delayed action, or referrals that were discussed but not sent.
- Pull out key documents such as referral letters, test results, and specialist correspondence.
- Build a timeline if you may need to complain or seek further care.
Many patients find the record validates what they suspected. Others find something more complicated. The notes may be partly supportive, partly inaccurate, and full of administrative gaps. That's normal. Your task is not to prove every entry is wrong. Your task is to identify the entries that matter to your care now.
A good next step is often to prepare a short written summary for the GP or specialist. Keep it focused. Set out the issue, refer to the relevant entries, attach the supporting pages, and state what you want to happen next. That could be correction of the record, reconsideration of a referral, or a formal complaint about the handling of your care.
Used properly, a subject access request to a GP gives you something many patients never get during a difficult NHS journey: a documented starting point.
Finally Seen Ltd helps UK patients create a documented paper trail with their GP by drafting formal, personalised letters that cite the relevant NICE guidance, along with complaints packs for escalation where needed. If you're trying to turn confusing care into something clear, written, and accountable, you can explore their guides and tools at Finally Seen Ltd.