Ask a room of patients whether they have ever seen their full GP record and most will say no. Ask whether they know they are entitled to it and the number drops further. Yet the right has existed in UK law for decades, and since 2018 it has been free to exercise. It is called a subject access request, and in my view it is the most under-used right in British healthcare.
What Is a Subject Access Request for GP Records?
Under UK GDPR, any person can ask an organisation that holds their personal data for a copy of it. In a GP practice that means personal data in the record – which can include consultations, letters, test results, referrals, medications, coded diagnoses and free-text notes. The practice should normally respond within one calendar month, and in most cases it cannot charge a fee. The Information Commissioner’s Office sets out the rules plainly, and the NHS has its own guidance for practices on how to comply.
There are limits. Certain information may be restricted under applicable exemptions, including where disclosure is likely to cause serious harm or would improperly disclose information about another person. Any exemption must be considered and justified. The default position is that the record belongs, in every practical sense, to the person it describes.
Why Patients Rarely Request Their Full GP Records
Having sat on both sides of this process, as a hospital consultant and as a GP practice clinical director, I think there are three honest reasons.
First, nobody tells patients. The NHS App has expanded access to GP record information, which is a real step forward, but the amount of historic information visible varies, and many people do not know the difference between online access and a formal subject access request. Second, the process is clunky. A request, any necessary identity check, a possible wait of up to a month or longer in certain cases, and then sometimes a PDF or a stack of paper that arrives with little structure or explanation. Third, once the copy arrives, it sits in a drawer. There is nowhere useful to put it.
The result is a right that exists on paper and barely exists in practice.
Why Access to Your GP Record Matters More Than Ever
Three things have changed the stakes.
Health data is moving. Records flow between GP systems, hospital trusts, Integrated Care Boards, shared care records and national programmes. A patient who has never seen their own record is asked to trust a system they cannot inspect.
Research demand is rising. Real-world evidence from primary care is now central to how medicines are evaluated and how services are planned. The people whose records fuel that evidence should be the first to see what those records contain.
Errors persist. In my clinical work I regularly see coded diagnoses that are out of date, allergies that were never removed, and letters filed to the wrong problem. A patient who can read their own record is the best safeguard the system has. That is not a criticism of colleagues. It is a recognition that no record is perfect and the person with the strongest interest in accuracy is the patient.
From Subject Access Requests to Patient-Held Records
A subject access request is one legal route to obtaining information for a patient-held record. It is how a person lawfully obtains a copy of the personal data their practice holds, subject to applicable exemptions, with the practice’s own verification behind it. What has been missing is somewhere to put it that is secure, structured and under the patient’s control.
That is what we built myOTR to do. The One True Record starts with the patient exercising their own right of access, brings the resulting record together with hospital and wearable data, and puts consent in the hands of the person the data describes. The aim is to give patients clearer permissions and visibility into how information they choose to share is accessed, within the relevant technical and legal arrangements. You can read more about how we handle that on our compliance page, and there is a plain-English explanation in our FAQs.
I want to be careful here. A subject access request is not a magic key and myOTR does not replace the GP record. The practice remains the data controller for the clinical record it holds. What changes is that the patient now holds a verified copy too, and can decide what happens to it.
What GP Practices Can Do to Support Patient Access
Tell patients the right exists. A line on the website and a poster in the waiting room costs nothing. Make the process digital where you can, with proper identity checks. Treat a request as a sign of engagement, not a nuisance. And when a patient spots an error, thank them.
How Patients Can Exercise Their Right to Access GP Records
Ask for your record. Read it. Check it. Then decide, on your own terms, who else should see it. That is what a right is for.
