Node 2: Legal & SAR Protocol

Statutory Rights & Subject Access Request (SAR) Playbook

A comprehensive legal guide under UK GDPR Article 15 & Data Protection Act 2018 for obtaining unredacted medical records, electronic access logs, and audit trails from NHS Trusts.

Statutory Window: 30 Calendar Days

Legislation: UK GDPR Art. 15 / DPA 2018 Sec. 45

Oversight Body: Information Commissioner's Office (ICO)

5-Step Forensic SAR Enforcement Workflow

Step 1: Precise Scope Definition

Request Full Electronic Audit Trails

Specify that your SAR includes not only PDF medical summaries, but full Electronic Patient Record (EPR) system logs, staff access timestamps, audit trail metadata, and entry change logs.

Step 2: Formal Submission to Data Protection Officer (DPO)

Direct Transmission

Submit your written SAR directly to the NHS Trust's DPO or Information Governance department via trackable email or registered post to establish a clear statutory countdown start date.

Step 3: Managing the 30-Day Compliance Clock

Enforce Timelines

Under UK GDPR Article 12(3), the Trust must respond within 1 calendar month. Complex extensions (up to 2 additional months) require explicit legal justification within the first 30 days.

Step 4: Countering Data Obfuscation & Redactions

Challenge Unlawful Exclusions

If a Trust provides heavily redacted records or omits staff access logs, challenge the redactions under UK GDPR Article 15(1)(c) demanding recipient categories and security access logs.

Step 5: ICO Complaint & Escalation

Formal Regulatory Complaint

If compliance fails at Day 30 without lawful cause, lodge an official complaint with the ICO referencing non-compliance with statutory disclosure mandates.

Standardized SAR Application Template

Copy and adapt this formal letter template when submitting your Subject Access Request to an NHS Trust:

RE: FORMAL SUBJECT ACCESS REQUEST (UK GDPR ARTICLE 15) To the Data Protection Officer / Information Governance Lead, [NHS Trust Name] I am formally requesting full access to my personal data and complete health records under Article 15 of the UK GDPR and Section 45 of the Data Protection Act 2018. Please supply: 1. Complete clinical records, GP correspondence, consultation notes, and hospital discharge letters. 2. Full system audit trails and Electronic Patient Record (EPR) access logs showing all staff logins, record modifications, and metadata timestamps. 3. Third-party disclosures and diagnostic radiology image files (DICOM format). Please acknowledge receipt and confirm compliance within the statutory 30-day window. Sincerely, [Your Full Name] [Date of Birth] | [NHS Number]

Examine Clinical Record Discrepancies

Move to Node 3 to analyze how audit trail gaps lead to clinical diagnostic overshadowing.

Proceed to Node 3: Clinical Cascade

🌐 Public Interest Forensic Audit Navigation Hub

🏛️ Node 1: Master Index (Home) 📜 Node 2: SAR Playbook ⚖️ Node 3: Clinical Cascade 🛡️ Node 4: Governance Notices