Skip to main content
Creating a new NHS England: Health Education England, NHS Digital and NHS England have merged. More about the merger.

How to make a subject access request

You have the legal right to request a copy of the information we hold about you, in line with the General Data Protection Regulation (GDPR).

If you want to see copies of your medical records, you should ask your GP or the health setting that provided your care or treatment. We do not hold medical records in the same format as a GP or hospital, for example GP notes, X-rays or scans.  

Learn more about how to access your health records

What information we hold

We collect some information from medical records, so that we can carry out our duties for the health and care service in England. Read more about the information we collect and the legal basis of these collections.

Where we store and use data collected from medical records, it is mostly held in the form of codes rather than words. We can check if there is any information about you stored in our collections. Where there is, we will send you a copy. We will give you a list of the codes used to help you understand the information we give you. Learn more about the health and care information we collect and why.  Where we process data about you, you can request to see it free of charge. (A reasonable fee may be charged in some cases, for example if repeated requests are made.)

If you work or used to work for NHS Digital, or related organisations that have now been replaced by NHS Digital, you can also request to see your employment records. 

How to make a subject access request for yourself

Only complete this form if you wish to obtain a copy of the coded/statistical information as held by NHS Digital in line with data protection legislation and return to the address below.

Please do not use this form if you require copies of your medical notes, (i.e. x-rays, scans, consultant/GP notes etc.) as we will not be able to assist you.

We require proof of your identity before we can disclose personal data. This should include copies of two documents such as:

  • your birth certificate
  • your passport
  • your driving licence
  • an official letter addressed to you at your address (e.g. bank statement, recent utility bill or council tax bill)

The documents should include your name, date of birth and current address. If you have changed your name please supply relevant documents evidencing the change.

We require one form of documentation to confirm name and a separate form of documentation to confirm address. Please note that proof of address must be dated within the last 3 months.  

Please fill in the subject access request form and email it to [email protected]   You will also need to include copies of information that confirms your identity.   

How to make a request for someone else

You can apply as a third party for someone that you are responsible for, including for a child, or for someone who has died. You will need to provide proof that you are allowed to act on their behalf. Health records are confidential so you can only access someone else’s records if you are authorised to do so. 

We do not hold medical records in the same format as a GP or hospital. If you want to see copies of someone else's medical records, you should ask your GP or the health setting that provided your care or treatment. Learn more about how to accessing someone else’s records. 

Advice for sending requests to the team

Due to the sensitive nature of the information needed to process your request, it would be preferable for us to receive your application via our secure email address: [email protected], rather than via post.

If you are unable or do not have access to email, our postal address is below. Thank you for your support and understanding.

Information Governance Delivery Team 
NHS England
7 and 8 Wellington Place
West Yorkshire

Our response

We will usually process your request within 30 days. As long as we have received proof of your identity. 

Following your request, we may write back to you within the 30-day time frame to request you to narrow or modify your requirements. This may also result in an extension of a further 60 days whilst we examine your request.

Information is provided in line with the General Data Protection Regulations (GDPR), Chapter 3, Article 15 (Recitals 63 & 64).

We want to understand our users better so we can improve our services.

Last edited: 21 March 2023 8:40 am