One of the other changes linked to the new guidelines relates to data subject access requests (SARs). An individual can make a SAR to any organisation that they believe is processing their personal data. This request must be in writing or email.

We have also created a Subject Access Request form for patients to complete. Under the new guidance, responses will be made within 30 days. An extension of two months can be allowed if necessary taking into account the complexity of the request.