NHS Subject Access Request: 2026 Family Guide (Free Pack)

The first letter you write for a CHC case is almost never the appeal letter. It's the Subject Access Request — the formal demand under UK GDPR for the medical and care records that will decide whether your relative's needs score the way they actually present, or the way the assessors imagine them. Most families don't realise they're doing data-protection law when they send it. The NHS body and the care home definitely do. And almost every losing CHC appeal we see at CareAdvocate has the same root cause: the SARs were sent too late, to the wrong people, or in a form the data controller could safely ignore.

This guide is the family handbook to running NHS Subject Access Requests for a Continuing Healthcare case in 2026. It explains your legal rights under UK GDPR Article 15 and the Data Protection Act 2018, the new "stop-the-clock" rule that came into force on 5 February 2026, what records to ask for from each NHS and care body, and how to chase or complain when the response is late or missing. Our free 6-letter Master Pack covers every recipient you're likely to need.

TL;DR: A Subject Access Request gives you the legal right under UK GDPR Article 15 to a copy of records held about a person within one calendar month. SAR complaints to the ICO rose 23% year-on-year to over 16,000 in 2022/23 (ICO, 2023), and from 5 February 2026 the Data (Use and Access) Act 2025 lets controllers "stop the clock" while verifying ID. For a CHC case you'll typically need SARs to six bodies: GP, hospital, ICB, care home, council, and mental health trust.

What Is a Subject Access Request and What Can You Get?

A Subject Access Request is your legal right under UK GDPR Article 15 and section 45 of the Data Protection Act 2018 to be told what personal data an organisation holds about you, and to receive a copy of it within one calendar month. There were 18,100 monthly UK searches for "subject access request" in May 2026 (DataForSEO, 2026). For NHS and care records, the data controller is whoever holds them — the GP practice, the hospital trust, the care home, the ICB, the council.

Three points families miss most often:

• The right belongs to the data subject — the person whose records are being requested. If they have mental capacity, they sign the SAR. If they don't, an attorney under a registered LPA, a Court of Protection deputy, or someone with formal authority can sign on their behalf. (See our deputyship family guide if you're applying for that authority now.)
• You can ask for everything, or you can be specific. A well-drafted SAR names the data subject, sets a date range, and lists the categories of record sought. Specificity speeds responses; vague requests trigger clarifying questions and reset the clock.
• A SAR is free for the first copy. Charges are limited to "reasonable fees" for further copies of the same records, or for manifestly excessive requests. NHS bodies almost never charge for a first copy.

For a CHC case, the SAR is the foundation. The National Framework for NHS Continuing Healthcare (Department of Health and Social Care, 2022 revision) requires that Decision Support Tool scoring be evidenced from contemporaneous records; verbal accounts at a Multi-Disciplinary Team meeting carry weight only when they're tied to records the panel can verify. The earlier you start the SAR process, the stronger the case becomes.

What Are the NHS-Specific SAR Rules?

Each NHS body is a separate data controller, which means you must send a separate SAR to each one — there is no single NHS portal. The statutory response time is one calendar month under UK GDPR Article 15 (NHS England SAR guidance, 2025). Hospital trusts, GP practices, ICBs, mental health trusts, and ambulance services all hold different categories of record, and only the body that holds them can release them.

Four NHS bodies you'll usually SAR for a CHC case:

• GP practice — Summary Care Record, full consultation notes, medication history, repeat prescriptions, referral letters in/out, and any safeguarding or capacity entries
• Hospital trust(s) — discharge summaries, inpatient nursing notes, consultant clinic letters, imaging reports, falls assessments, and any escalation or rapid-response records
• Integrated Care Board (ICB) — CHC checklist forms, full Decision Support Tool documents, MDT meeting minutes, decision letters, and any internal reviewer notes on the file
• Mental health trust (where relevant) — Care Programme Approach reviews, section 117 aftercare records, behaviour monitoring, and crisis team contact logs

The ICB SAR is the one most families forget — and it's often the most decisive. The ICB's internal reviewer notes on a refused checklist or DST will frequently expose the precise reasoning the Decision Support Tool didn't show. If you're already in a CHC appeal, the ICB SAR is non-negotiable.

A particularly common gap: families assume the GP holds everything because the GP is the medical "centre of gravity." In practice, the GP record describes primary care contacts, but the daily reality of someone in a care home or recovering from a stroke is captured by the care home and the hospital trust — not the GP. SARing only the GP is the single most common reason a CHC evidence pack reads thin.

How Do You SAR a Care Home or Local Authority?

Care homes and local authorities are independent data controllers under UK GDPR — exactly the same legal framework as the NHS, with the same one-calendar-month response window. Care home records are the strongest single source of CHC evidence in most cases because they document daily care needs in the granular detail the Decision Support Tool requires. Local authority adult social care records add the Care Act assessment trail that often shows the trajectory of decline.

The records that win CHC cases — and the bodies that hold them:

• Care home — daily care notes, incident logs, falls register, medication administration records (MAR charts), continence charts, fluid and nutrition charts, behaviour monitoring sheets, key worker notes, complaints log, and any safeguarding referrals
• Local authority adult social care — Care Act needs assessment, financial assessment, care and support plans, review notes, social worker case notes, and any safeguarding records
• Council deprivation of liberty team — DoLS authorisations and best-interests assessments (essential reading where a DoLS authorisation is in place)

Care homes vary enormously in how cleanly they handle SARs. Larger groups (HC-One, Barchester, Care UK) usually have a published process and a designated information governance contact. Smaller independent homes sometimes panic, ask for fees they're not entitled to, or try to redirect the request to the council. None of those responses are correct under UK GDPR. If you hit pushback, restate the legal basis (Article 15) and copy in the ICO by way of warning.

Practical tip: Care home daily notes are the part most families never think to request — and the part that most often surprises a CHC panel. A 12-month run of daily notes for a resident with vascular dementia routinely reveals frequency and intensity of need that the rest of the medical record never captures. Request them early, request them in full.

What Is the 30-Day Rule and How Did It Change in 2026?

The standard response time for any UK SAR is one calendar month from the day the data controller receives a valid request, set out in UK GDPR Article 12(3). For complex requests, this can be extended by a further two months with written reasons. From 5 February 2026, section 76 of the Data (Use and Access) Act 2025 introduced a "stop-the-clock" mechanism — controllers can pause the clock while verifying the requester's identity, and the time only restarts once verification is complete (DSAR Tracker, 2026).

How families can keep the 30-day clock running

The practical impact for families:

• Provide ID upfront in the SAR letter. Send a copy of the data subject's photo ID and proof of address with the original request. If you're acting under an LPA or deputyship order, send a copy of that. This pre-empts the stop-the-clock and keeps the calendar running from day one.
• Specify a date range. Open-ended requests trigger clarifying questions, which legitimately delay processing. "All records from 1 January 2022 to date" is concrete and harder to bounce.
• State the legal basis. Reference UK GDPR Article 15 and DPA 2018 s.45 in the letter. Some smaller controllers — particularly care homes — try to treat SARs as "informal record requests" they can handle on their own timetable. The statutory references force the calendar.

The June 2026 internal-complaints requirement

A second 2026 change worth knowing about: from 19 June 2026, every UK organisation acting as a data controller — including all NHS bodies, ICBs, care homes, and councils — must operate a formal internal complaints process for data-protection complaints (Herrington Carmichael, 2026). For families chasing late SARs, this means a clearly identifiable internal escalation route exists by law, not just by goodwill.

How Do You Write a Subject Access Request Letter?

A SAR doesn't need a specific form. A short letter or email referencing UK GDPR Article 15 and Data Protection Act 2018 s.45 is sufficient — but the difference between a SAR that gets answered in 28 days and one that drifts to 60 is almost always in how the letter is drafted. Our free 6-letter Master Pack covers GP, Hospital, Care Home, ICB, Local Authority Adult Social Care, and Mental Health Trust, plus a chase letter and a complaint letter.

Five elements every SAR letter must include

1. Identity of the data subject. Full name, date of birth, NHS number where known, last known address, and any previous addresses or names. The data controller has to match these against their records.
2. Identity of the requester (if not the data subject). If you're acting under an LPA, deputyship, or parental responsibility, state the basis and attach a copy of the order. If the data subject can sign, their signature alone is sufficient — but a covering note from the family member acting as point of contact speeds the response.
3. Date range. "All records from 1 January 2020 to the present" is concrete. "Everything you have" is open-ended and triggers clarifying questions.
4. Records sought. Be specific to the recipient: a GP SAR asks for consultation notes, repeat prescriptions, referral letters, and the Summary Care Record. A hospital SAR asks for discharge summaries, inpatient notes, imaging reports, and clinic letters. A care home SAR asks for daily notes, MAR charts, incident logs, and key worker notes.
5. Delivery preference. Electronic delivery (email or secure portal) is faster and free; postal delivery to a specified address is acceptable but slower.

A SAR letter is a legal instrument, not a polite enquiry. Drafting it that way — with the statutory references, the date range, and the recipient-specific record list — is the difference between a record bundle that lands in 30 days and a request that gets bounced for clarification. If you'd rather not draft six different letters by hand, download the Master Pack — every letter is pre-drafted, statutorily referenced, and ready to fill in.

What Happens When Records Are Late, Missing, or Refused?

When the 30-day window expires without a response, the law has already been breached — but in practice, NHS bodies and care providers rarely face consequences without family pressure. The escalation route is straightforward: chase letter at day 31, internal complaint at day 45, ICO complaint at day 60. The Information Commissioner's Office received over 16,000 SAR-related complaints in 2022/23, a 23% rise on the year before (ICO, 2023). Most of those complaints succeed.

The four-step escalation pattern that works

• Day 31 — Chase letter. Reference the original request date, restate the legal basis, and give the controller seven days to respond. Most NHS bodies respond at this stage when prompted; many care homes too. Our Master Pack includes this letter.
• Day 45 — Internal complaint. Lodge a formal complaint with the data controller's information governance lead (NHS bodies and ICBs all have one; care homes and councils usually do too). From 19 June 2026 every controller must operate this process by law.
• Day 60 — ICO complaint. File a free complaint at ico.org.uk. The ICO can require disclosure, impose fines, and (rarely) prosecute. The threat alone often resolves the matter; an actual referral is reserved for serial breaches.
• Day 75+ — Single-issue Court of Protection or High Court route. Almost never needed for SARs alone, but available where records are blocking a time-critical decision (CHC fast-track refusals, contested DoLS challenges, urgent care decisions).

When can a controller legitimately refuse?

What records can a controller legitimately refuse to release? UK GDPR includes a small set of exemptions: third-party data identifying others (which can be redacted, not withheld whole), legally privileged material, criminal investigation evidence, and information likely to cause serious harm to the data subject's mental health. None of these justify withholding the bulk of a CHC-relevant record. If a refusal letter cites a vague "third-party concern" to refuse the entire file, that's a red flag — and an ICO complaint usually unblocks it.

Which Records Win CHC Cases?

Not all records carry equal evidential weight in a CHC assessment. The Decision Support Tool weighs evidence against the FICU criteria — Frequency, Intensity, Complexity, and Unpredictability — and certain record types speak directly to those four criteria while others only speak to general clinical history. From the cases we work on at CareAdvocate, the records that move the needle in CHC decisions are usually the same five.

The five record types ranked by FICU evidential weight

The order makes intuitive sense once you see the FICU lens applied:

• Care home daily notes — speak directly to Frequency and Intensity. The most granular record of what the person actually needs each day. Where most successful CHC cases live or die.
• ICB MDT minutes and reviewer notes — speak directly to Complexity and the assessor's reasoning. Where you find the precise scoring rationale to challenge.
• GP consultation notes — speak to Unpredictability through escalations, falls clinic referrals, and changes in medication. Necessary but not sufficient.
• Hospital discharge summaries — capture the highest-acuity periods. Useful for showing the trajectory of decline.
• Medication administration records (MAR charts) — quantify the medication burden, which feeds the Drug Therapies and Medication domain on the Decision Support Tool.

Our finding: On nine out of ten CHC appeals we review at CareAdvocate, the family submitted GP records and hospital discharge summaries — but didn't ask for care home daily notes or ICB MDT minutes. Adding those two record types alone is, in our experience, the single highest-leverage SAR action a family can take.

For deeper reading on the well-managed-needs trap that often hides in care home daily notes, see our piece on well-managed needs in CHC.

What's Different About a SAR for a CHC Appeal?

A SAR for an initial CHC assessment usually covers the most recent 12 months — enough to scope the current care needs against the Decision Support Tool. A SAR for a CHC appeal, particularly a retrospective claim under the Previously Unassessed Period of Care route, goes back further — typically to the onset of significant deterioration, which can mean three, five, or more years of records. The data controller's obligation to provide records is the same, but the volume is much larger and the controller may legitimately request the extension under UK GDPR Article 12(3).

Three things that change for an appeal SAR:

• Date range expands significantly. "All records from January 2018 to the present" is reasonable for a retrospective appeal where the family is reconstructing the care need pattern over multiple years.
• You'll need ICB internal-decision records. The original DST, the original checklist, the Local Resolution meeting notes, and the Independent Review Panel papers all need to be requested explicitly. They're often missing from the initial assessment SAR.
• You can SAR archived records. Under the NHS Records Management Code of Practice 2021, adult health records are retained for 8 years after the last contact and care home records for at least 3 years; both retain longer in practice. Archived records take longer to retrieve but they're still subject to the SAR.

If the appeal is heading toward an Independent Review Panel, the SAR pack is the foundational evidence the IRP will read. Our CHC appeal pillar walks through how the panel uses the records.

What to Do With the Records Once They Arrive

The hardest part of a SAR isn't writing the letter; it's reading the response. A 12-month run of care home daily notes can run to 1,500 pages. Six SAR responses for a CHC appeal can stretch into 5,000+ pages of mixed PDFs, scanned forms, handwritten notes, and structured nursing reports. Most families need a system.

A practical approach we use:

1. Index by date. Create a single chronological master timeline drawing from every record source. Each entry: date, source, one-line summary.
2. Tag against the 12 DST domains. As you read, tag each entry with the relevant CHC care domain — Behaviour, Cognition, Continence, Mobility, etc.
3. Flag the FICU markers. Every entry that speaks to frequency, intensity, complexity, or unpredictability is gold — highlight it.
4. Summarise per domain. End-state output is a 1-page summary for each of the 12 domains, with bullet evidence from the records.

That's what an evidence pack actually looks like — not a 5,000-page bundle, but a 12-page domain-by-domain summary, backed by indexed source records the assessor can verify. If you'd rather not run that exercise yourself, our Case Strength Report (£97) reviews the records you've gathered and produces the same domain summary as a starting point.

Frequently Asked Questions

The five questions families ask us most often about NHS Subject Access Requests are answered in the FAQ block at the top of this page (visible to search engines as structured data). They cover timing, fees, care home records, what to do when responses are late or missing, and whether a SAR is necessary for a CHC case. For broader CHC questions, see our NHS Continuing Healthcare FAQ.

In Summary

• A Subject Access Request is your statutory right under UK GDPR Article 15 to a copy of records held about a person within one calendar month.
• For a CHC case you'll typically SAR six bodies: GP, hospital trust, ICB, care home, local authority adult social care, and (where relevant) mental health trust.
• From 5 February 2026 the Data (Use and Access) Act 2025 lets controllers "stop the clock" while verifying ID — provide ID upfront in the original letter to keep the calendar running.
• From 19 June 2026 every controller must operate a formal internal complaints process — your escalation route is law, not goodwill.
• Care home daily notes and ICB MDT minutes are the two record types most often missed by families and most often decisive in CHC cases.
• The Information Commissioner's Office receives 16,000+ SAR complaints a year — chasing and complaining usually works (ICO, 2023).

If you're starting a CHC case from scratch, the first practical step is the SAR. Download our free 6-letter Master Pack, pick the recipients that apply to your relative's situation, and start the calendar. For background on what the records will be assessed against, read the NHS Continuing Healthcare guide or run our free CHC eligibility screener to test whether a checklist screening is worth requesting.

---

This guide is reviewed by legal professionals and social care professionals. It is general information for families and does not constitute legal advice for an individual case. UK GDPR and the Data (Use and Access) Act 2025 are technical statutes; for contested SARs, refused records, or ICO complaints we recommend speaking to a data-protection-experienced solicitor.