Last updated:

Subject access requests to GP practices increase by a third since GDPR legislation came in

The number of subject access requests (SARs) GP practices are receiving each month from patients and their representatives have increased by more than 30 per cent since the introduction of GDPR legislation, according to a survey of GPs by the BMA.

More than 1,500 GPs1 responded to an online survey asking how many SARs they received each month on average in the year prior to the introduction of GDPR in May, and then how many they had received in the last calendar month.

The average before May was 8.57 requests a month, while the average received in the past month was 11.68, implying a rise of 36 per cent.

While GPs were previously allowed to charge a reasonable fee to cover the administrative costs of completing subject access requests, GDPR means they must now be done free of charge unless the request is “manifestly unfounded” or “excessive”. 

The survey also found that, on average, more than three-quarters (77 per cent) of requests were made by companies acting on behalf of the patient, such as solicitors, compared to 22 per cent by the patient themselves.

Dr Richard Vautrey, BMA GP committee chair, said: 

“These findings reflect what we’d been hearing anecdotally for some time – that GP practices are facing a significant increase in the number of subject access requests now that GDPR legislation has come into force, meaning the double hit of an increase in work and a decrease in funding, at a time when most are already under enormous pressure.

“While patients have every right to access their own medical records, the majority of these requests are from companies potentially exploiting a system by which they no longer have to pay out of their own pocket and so the cost is transferred to the NHS – coming at a serious price for general practice. The work required to process records or produce reports is not part of the NHS contract, which means doctors and their teams are now having to cope with this growing workload at the expense of other important activities – and crucially, time spent on this is taken away from providing core services to patients.

“If practices are expected to meet the demand for these requests and practices are unable to charge a fee for reports to cover their costs, then the Government must provide funding, and we are actively pushing for this in ongoing contract negotiations.

“Furthermore, if the Secretary of State for Health and Social Care is serious about his digital revolution in the NHS, he should commit to an IT solution that would allow all practices to offer patients access to their entire record in a safe and secure way. This would relieve GPs and their staff of some of the administrative workload burden of dealing with such requests, prove far more cost effective in the long-term and empower patients by having a greater understanding of their care.”


Notes to editors

The BMA is a trade union representing and negotiating on behalf of all doctors in the UK. A leading voice advocating for outstanding health care and a healthy population. An association providing members with excellent individual services and support throughout their lives.

  1. GPs were invited to fill in an online survey between 5th and 30th September. The survey received 1,571 complete responses. 
  2. The BMA provides information for doctors on their GDPR obligations here.

For further information please contact:

British Medical Association, BMA House, Tavistock Square, London, WC1H 9JP
Telephone: 020 7383 6448 
Email: [email protected]
Media centre | Twitter | Youtube - BMA TV | Flickr