Tip · Digital and cyber · 4 Aug 2026 · 2 min read

Subject access requests: how the one-month clock works

Patients can ask for their records verbally or in writing. Here is when the one-month response clock starts, pauses and can be extended.

01 / What's changed

Nothing new in the basics. The ICO updated its subject access guidance in July 2026 to reflect the Data (Use and Access) Act 2025.
You must respond without undue delay and within one month of receiving the request. You can extend by up to two further months if the request is complex or the person has made several requests, but you must tell them within the first month and say why.
If you reasonably need clarification, the clock pauses from the day you ask and restarts the day after you get a reply.

All UK GP practices handling requests for copies of records, including requests made by solicitors or other third parties on a patient's behalf.

Train reception and admin staff to recognise a request in any form. It can be verbal or written, including on social media, and needs no special wording.
Log verbal requests as soon as they are made, with the date received.
Ask for ID only where it is reasonable and proportionate. The clock does not start until you receive information you have asked for, such as ID or a third party's proof of authority.
Do not charge a fee as standard. A reasonable fee is only allowed for manifestly unfounded or excessive requests, or for further copies.