Subject Access Request Procedure

Subject Access Request (SAR) Procedure

Helen Ward Therapy
Trading name of ResolvedRM Ltd

Version: 1.0
Effective Date: 30/05/26
Review Date: 30/05/27

1. Purpose

Helen Ward Therapy recognises that individuals have rights regarding the personal information held about them under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Subject Access Request (SAR) Procedure explains how requests for access to personal information will be received, assessed, managed and responded to.

The purpose of this procedure is to ensure that requests are handled fairly, consistently and within the requirements of data protection legislation.

2. Scope

This procedure applies to requests made by individuals seeking access to personal information held by Helen Ward Therapy.

This may include requests from:

current clients;
former clients;
prospective clients;
other individuals whose personal information is processed by the practice.

3. What is a Subject Access Request?

A Subject Access Request is a request made by an individual to access personal information held about them.

An individual has the right to:

know whether their personal information is being processed;
receive a copy of their personal information;
understand how their information is being used;
receive information about the purposes of processing.

4. Making a Subject Access Request

Requests should normally be made in writing and sent to:

Helen Ward Therapy
Email: connect@helenwardtherapy.com

A request should include:

the individual's name;
contact details;
sufficient information to identify the person making the request;
details of the information being requested (where possible).

A request does not need to use the words "Subject Access Request" to be valid. Any request that clearly asks for access to personal information will be treated as a SAR.

5. Identity Verification

Before providing personal information, Helen Ward Therapy must be satisfied that the person making the request is entitled to receive the information.

Appropriate identification may be requested where necessary.

This is to protect confidentiality and prevent personal information being disclosed to an unauthorised person.

6. Responding to Requests

Helen Ward Therapy will respond to valid Subject Access Requests without undue delay and normally within one month of receiving the request.

Where a request is complex or multiple requests have been made, the response period may be extended by a further two months where permitted by UK GDPR.

If an extension is required, the individual will be informed within one month of the request, including the reason for the delay.

7. Information Provided

Where appropriate, individuals will receive:

copies of their personal information;
information about how their data is processed;
details of the purposes for processing;
information about retention periods;
information about their data protection rights.

Information will normally be provided in a commonly used electronic format unless another format is agreed.

8. Therapy Records and Clinical Information

Helen Ward Therapy recognises that therapy records require careful consideration due to their sensitive nature.

Clinical records are maintained to support safe and effective therapeutic practice and are not created as a transcript of therapy sessions, a report, or a professional opinion for external use.

A Subject Access Request provides access to personal information held about an individual. It does not require Helen Ward Therapy to create:

reports;
summaries;
opinions;
assessments;
interpretations;
statements;
letters;
other documentation not already held.

Helen Ward Therapy does not provide reports or written documentation for external purposes except where required by law.

9. Consideration of Exemptions and Restrictions

Before releasing information, Helen Ward Therapy will consider whether any lawful restrictions apply.

Information may be withheld or redacted where:

disclosure would seriously harm the physical or mental health of the individual or another person;
information relates to another identifiable person;
legal privilege applies;
another exemption under UK GDPR or the Data Protection Act 2018 applies.

Where information is withheld, the individual will normally be informed of this and provided with an explanation where legally permitted.

10. Third-Party Information

Where records contain information about another identifiable person, that information may be removed unless disclosure is appropriate and lawful.

The confidentiality and privacy rights of others will be respected.

11. Fees

Subject Access Requests are normally provided free of charge.

A reasonable fee may only be charged where requests are manifestly unfounded, excessive, or repetitive, in accordance with UK GDPR requirements.

12. Confidentiality and Security When Providing Information

Information provided in response to a SAR will be shared securely.

Appropriate measures will be taken to ensure that confidential information is provided only to the person entitled to receive it.

13. Recording and Managing Requests

Helen Ward Therapy will maintain an appropriate record of Subject Access Requests received, including:

date received;
identity verification completed;
information provided;
date responded to;
any decisions to restrict or withhold information;
reasons for decisions.

14. Right to Complain

If an individual is dissatisfied with how their Subject Access Request has been handled, they are encouraged to contact Helen Ward Therapy initially so concerns can be reviewed.

Individuals also have the right to complain to the Information Commissioner's Office (ICO).

ICO Reference: ZC204139

15. Responsibilities

As a sole practitioner, Helen Ward is responsible for:

managing Subject Access Requests;
ensuring responses comply with UK GDPR;
protecting confidentiality;
applying appropriate professional judgement;
maintaining records of requests and responses.

16. Policy Review

This procedure will be reviewed annually or sooner where there are changes to:

data protection legislation;
professional guidance;
practice procedures.