Subject Access Requests in an Orthodontic Practice: A Step-by-Step Guide to Handling Patient Record Requests

A subject access request in an orthodontic practice can arrive as a formal letter, a solicitor's email, a text message from a parent or a comment at the front desk, and the clock starts the moment any member of staff receives it. Patients are entitled to a copy of their personal data under the UK GDPR, and orthodontic records are rich: photographs, scans, radiographs, treatment plans, consent forms, messages and payment history. This guide sets out what counts as a request, the time limits the Information Commissioner's Office (ICO) applies, how to verify identity, what to do about records that mention other people, and a step-by-step process the whole team can follow.

What is a subject access request, and who can make one?

A subject access request is a request by or on behalf of a person for the information they are entitled to under article 15 of the UK GDPR: confirmation that you hold their data, a copy of it and supplementary information about how it is used. The ICO is clear that there are no formal requirements. A person can ask verbally or in writing, including through social media, to any part of your organisation, and they do not need to use the words subject access request.

In an orthodontic practice that means a valid request can be any of the following:

The ICO suggests training staff to identify requests and keeping a policy for recording those made by phone or in person. A short log with the date received, who received it, the channel and what was requested is enough to start with.

How long does the practice have to respond?

The practice must respond without undue delay and at the latest within one month of receiving the request. The ICO explains how to count: start from the actual date you receive the request, or the date you receive any information you asked for to confirm identity, and count forward to the same date in the following month. If that day falls on a weekend or bank holiday, you have until the next working day. A request that arrives on 14 May is due by 14 June.

If you need a consistent rule for the front desk, the ICO notes you could adopt a 28-day period internally so that you always comply within a calendar month.

When can the deadline be extended?

You may extend the time limit by up to two further months, giving three months from the original start date, if the request is complex or the person has made a number of requests, for example a SAR plus a request for erasure. You must tell the person within the first month that you are extending and explain why. A large volume of records is not by itself a reason; the ICO looks at complexity.

Can you stop the clock?

Yes, in one specific situation. If you genuinely need the person to clarify what they are asking for, the clock stops on the day you ask and resumes the day after they reply. The ICO is clear that the clock only stops for clarification about the information requested, not for other questions such as the format of your response. Ask for clarification and for identification as early as possible, and still search for the information in the meantime.

How do you verify identity without making it difficult?

You can ask for enough information to be sure the requester is the person the records are about, or is authorised to act for them, but the ICO expects you to be reasonable and proportionate. It advises requesting formal identification documents only where necessary and using verification you already hold where possible. For a current patient who is logged into your patient portal or confirms their date of birth, address and treatment dates against your records, a passport copy is usually excessive.

For a third party such as a solicitor or relative, the ICO says you need to satisfy yourself that they are authorised, normally through a signed authority from the patient. Treat the request as if the patient had made it. A parent asking about a child raises separate considerations, because the right belongs to the child. A young person who is old enough to understand their rights may be the right person to decide who sees their records, so consider the child's maturity and the circumstances, and take advice where it is unclear.

What information must you provide?

The patient is entitled to a copy of their personal data plus supplementary information: the purposes of processing, the categories of data, who it is shared with, the retention period, their rights to correction, erasure, restriction and objection, and their right to complain to the practice and the ICO. If your privacy notice already contains the supplementary information, the ICO says you can point the person to it.

An orthodontic record is wider than the clinical notes. When you search, work through each place where personal data lives:

You are required to carry out a reasonable and proportionate search, not to turn the practice upside down. If the request is broad, such as everything you hold about me, the ICO says it is reasonable to ask the person to clarify and to explain that you are only required to carry out a proportionate search. Our guide to accessing orthodontic records explains the same process from the patient's side, which is useful to share with the person making the request.

What can you withhold, and how do you protect other people?

The right of access is not absolute. The Data Protection Act 2018 contains exemptions, and the ICO's guidance on exemptions and special cases, including health information, explains when they apply. Three situations come up most often in practices.

What is the step-by-step process for handling a SAR?

The targets are suggestions for a practice, not legal deadlines. The legal limit is one month, so build in time for review and for the unexpected, such as a patient replying slowly to a query.

How should you send the records securely?

You must deliver the information securely, particularly because the data is health information. The ICO advises that responding on social media is generally not secure and that you should ask for alternative delivery details instead. For orthodontic records, practical options include a password-protected download link with the password shared by a different channel, a secure patient portal, encrypted email or a physical copy collected in person with ID. Always send to the address you have verified, and record how the response was delivered.

If the request comes from a patient who is transferring to another orthodontist, many practices also have clinical and professional reasons for sharing records quickly. Our post on a referral back letter and the guide on treatment cancellation cover related handovers.

How do you prepare the practice before a request arrives?

The best SAR response is built before anyone asks. Preparation also makes a practice more resilient if it is inspected by the Care Quality Commission, because inspectors look for evidence of good information governance and well-led management.

If your team is not confident about the wider data protection rules, our plain-English GDPR guide for orthodontic practices and the post on the orthodontic consent process are good starting points. The guide to practice insurance is also worth reading because indemnity and cyber policies can include data protection support.

What happens if you get it wrong?

The ICO is the regulator, and a patient who is unhappy with the way their request was handled can complain to it. Missing deadlines, ignoring requests and failing to search properly are among the common reasons for complaints. The ICO can take enforcement action in serious or repeated cases. The risk for most practices is not a headline penalty but the cost in time, reputation and trust when a simple records request becomes a complaint, a Google review and a regulator query at the same time.

Handling requests well also supports your wider complaints approach. Our guide to a CQC-compliant complaints procedure shows how to log, investigate and learn from problems, and the same discipline applies here.