Subject Access Request

What is the right of access?

The right of access, commonly referred to as subject access, gives individuals the right to obtain a copy of their personal data, as well as other supplementary information. It helps individuals to understand how and why you are using their data, and check you are doing it lawfully. This is covered in the Data Protection Act 2018 and Article 15 of the UK GDPR.

What is Article 15 UK GDPR?

The General Data Protection Regulation (GDPR), under Article 15, gives individuals the right to request a copy of any of their personal data which are being 'processed' (i.e. used in any way) by 'controllers' in this case South Western Ambulance Service are the data controller (i.e. those who decide how and why your data is processed), as well as other relevant information. 

You have the right to access and receive a copy of your personal data, and other supplementary information. This is commonly referred to as a subject access request or ‘SAR’. You can make SARs verbally or in writing to us using the following email address SDPlus.InformationGovernance@SWAST.nhs.uk including via social media on our SWAST website.

A third party can also make a SAR on your of behalf but we will need them to provide evidence that they are able to act on your behalf so that we do not release any information to the wrong person. Or we may ask for your direct consent to check that you are satisfied with someone else to request your information on your behalf.

Information about a deceased person does not constitute personal data and therefore is not subject to the UK GDPR. Information about us as a public authority is not classed as personal data and therefore would not fall under this legislation.

The information will be provided to you free of charge, however there are certain circumstances when we may be able to charge or withhold this information.

Please see the link for more information ICO Information Commissioner's Office (ICO)

What about requests for information about children?

Before responding to a SAR for information held about a child, we need to consider whether the child is mature enough to understand their rights.

If the request is from a child and you are confident they can understand their rights, you should usually respond directly to the child. You may, however, allow the parent or guardian to exercise the child’s rights on their behalf if the child authorises this, or if it is evident that this is in the best interests of the child. If a child is competent, they may authorise someone else, other than a parent or guardian, to make a SAR on their behalf.

If you would like copies of your information, please get in touch with our Information Governance Team, they will be happy to assist you.

You are able to request copies of your information verbally or in writing, including via social media.

How to request personal information or further details

If you want to make a subject access request ‘Rights of Access’ request for personal data held in respect of any services provided by the trust, or request any of the details set out here, you should send it in writing (email or letter) to:

SDPlus.InformationGovernance@SWAST.nhs.uk

or

Information Governance Team,
South Western Ambulance Service NHS Foundation Trust
Abbey Court
Eagle Way
Exeter
Devon
EX2 7HY

Or you can complete our online form here  which will be sent directly to our IG Team, an acknowledgment will be sent to you with confirmation of how long your request may take, as standard all requests will be completed within 30 days but if your request will take a bit longer  for us to process as will be classified as ‘complex’ then we are able to extend your request by up to 2 months as long as you receive confirmation of this within one month of your initial request.

When is a request complex?

Whether a request is complex depends upon the specific circumstances of each case. What may be complex for one controller may not be for another – the size and resources of an organisation are likely to be relevant factors. Therefore, you need to take into account your specific circumstances and the particular request when determining whether the request is complex.

The following are examples of factors that may, in some circumstances, add to the complexity of a request. However, you need to be able to demonstrate why the request is complex in the particular circumstances.

• Technical difficulties in retrieving the information – for example if data is electronically archived.
• Applying an exemption that involves large volumes of particularly sensitive information.
• Clarifying potential issues around disclosing information about a child to a legal guardian.
• Any specialist work involved in obtaining the information or communicating it in an intelligible form.
• Clarifying potential confidentiality issues around the disclosure of sensitive medical information to an authorised third party.
• Needing to obtain specialist legal advice. If you routinely obtain legal advice, it is unlikely to be complex.
• Searching large volumes of unstructured manual records (only applicable to public authorities).

Please Note:- We will require your identification in order to ensure that you are entitled to copies of the information we hold about you. This will be in the form of a passport, driving licence or any other appropriate documentation we may ask for in order to prove your identity.

If you need to speak to our Information Governance Team please email SDPlus.InformationGovernance@SWAST.nhs.uk