Case file

Excessive SAR request

Neon speech bubbles
  • Date: 23 June 2023
  • |
  • 3 minute read

A practice manager contacts MDDUS for advice on a subject access request (SAR). Mrs T wants voice recordings of every phone call that she has made to the surgery, as well as call backs from practice staff. She is a frequent caller to the surgery.

The practice manager points out that relevant details from telephone consultations are always recorded in the patient notes by GPs or other clinical staff. Phone calls to administrative staff regarding general queries are not written up unless advice from a clinician is necessary.

Copies of written patient records could easily be made available to Mrs T. But to search out and extract recordings of every call to the practice in which she was a party could involve a great deal of work and the practice manager feels this would be excessive.


An MDDUS medical practice adviser responds to the advice request. She explains that patients have a right of access to a copy of their personal data as stipulated in law under the Data Protection Act (DPA) 2018 and UK GDPR. Voice recordings of telephone calls to the practice would be included in the data that can be requested under a SAR, as the information contained within such telephone calls is data about the patient.

The Information Commissioner’s Office (ICO) provides guidance to organisations on SARs, including when it is reasonable to refuse a request. This may include, for example, if a request is considered “manifestly excessive”.

The ICO states that to determine whether a request is manifestly excessive involves considering whether it is “proportionate when balanced with the burden or costs involved in dealing with the request” but it will not be “necessarily excessive just because the individual requests a large amount of information”. The ICO further states organisations should consider each request individually and not apply a blanket policy on what is considered excessive.

The MDDUS adviser suggests that the practice takes all reasonable steps to comply with the SAR, including seeking assistance from their telephone provider on how to extract the calls. If on review and exploration of the feasibility of complying, the practice considers the request to be manifestly excessive then it may refuse, in line with the ICO guidance. The practice should be prepared to justify their decision, which can usually be achieved by explaining how the guidance has been applied to the request.

If there was an exemption, and the practice refuse the SAR, the practice must then contact Mrs T and explain the reasons why the request has been refused and inform her of her right to refer the matter to the ICO, or to seek to enforce her request through the courts.

The MDDUS adviser further suggests that a compromise might involve Mrs T narrowing her request to certain telephone calls, or over a specific period.


  • Patients have a legal right of access to a copy of their personal data. Recordings of telephone calls are considered personal data and therefore may be requested under a SAR.
  • There are circumstances in which a SAR may be refused, such as when an exemption applies, or if a request is “manifestly unfounded” or “manifestly excessive”. Practices should follow ICO guidance when considering whether an exemption applies to a request.
  • If a request is refused, the requestor should be informed of the reasons why. They should also be informed of their right to make a complaint to the ICO, and that they may seek to enforce this right through the court. Organisations should be prepared to justify this decision.

This page was correct at the time of publication. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.

Related Content

GDPR: Managing subject access requests

GDPR: Managing data security breaches

An introduction to Privacy Notices

Save this article

Save this article to a list of favourite articles which members can access in their account.

Save to library

For registration, or any login issues, please visit our login page.