How to exercise your personal data rights

It is important to understand how to exercise your personal data rights. Doing it the wrong way may lead to unnecessary delays in processing your request. Requests are usually processed within one calendar month.

You must:

  1. Determine the records you want to access and why.
  2. Specify a particular period. For example, the calendar year 2020.
  3. Take note of the service you dealt with. Remembering the location and any business representatives involved will help to retrieve your personal data much quicker.
  4. Find out whether you are entitled to make the request. This is important when making requests on behalf of another person.
  5. Complete a data subject access request (DSAR) form. You can download the form in your preferred format using the links below.
  6. Forward the completed form to or post it to the physical address on the form.

Frequently asked questions

The information below will help you determine whether you are authorised to make a DSAR. All DSARs are subject to identity checks, which may include a request to see one or more of the below:

  • A valid or ‘in date’ nationally accepted photo ID – passport, driving licence, citizen or NUS card
  • Correspondence from a public authority dated within the last three months
  • Proof of residence or utility bill dated within the last three months
  • Valid proof of parental rights

Who can make a valid request:

Owner of personal data Who can make a DSAR
For a child under the age of 13 A parent, guardian, foster parent, advocate or legal representative
For a young person between 13-16 years of age The individual, a parent, guardian, foster parent, advocate or legal representative
For a person 16 years of age and older The individual, a nominated person, advocate or legal representative
For a person older than 16 years of age but without capacity to consent (due to ill health or disability) A parent, guardian, advocate or legal representative
For a deceased person Person named in the letter of administration or an executor with grant of probate

If your request is not clear or it appears excessively demanding and burdensome, we might seek more information from you. If this is required, the team will get in touch via your preferred method of contact. You could be asked to:

  • clarify the reason for requesting access;
  • provide a date or time range; and
  • narrow your request to relevant records only.

When we do this, we will normally allow you 14 days to respond. During these 14 days, the one month calendar countdown will be paused.

Yes. A DSAR may be refused when:

  • a requester has made more than two repetitive requests within the current calendar year;
  • our data protection officer judges the request to be manifestly unfounded or excessive in nature; or
  • there are legal prohibitions or safeguarding concerns for the requester or other persons at that particular time.

The team dealing with your DSAR will let you know our decision in good time and in any case no later than one calendar month.

GreenSquareAccord is compliant with the national data opt-out. For more about national data opt-out, and to choose your preference, please visit the NHS website.