Subject access requests rise under GDPR

SUBJECT access requests to GP practices have increased by more than 30 per cent since the introduction of GDPR (General Data Protection Regulation) legislation, according to a survey by the BMA.

An online survey of over 1,500 GPs queried the number SARs received each month on average in the year prior to the May introduction of GDPR in comparison to the number received in the last calendar month.

It found that the average before May was 8.57 requests a month compared to 11.68 in the past month, a rise of 36 per cent.

The survey also found that, on average, more than three-quarters (77 per cent) of requests were made by companies acting on behalf of the patient, such as solicitors, compared to 22 per cent made directly by the patient.

GPs were previously allowed to charge a reasonable fee to cover the administrative costs of completing SARs but under the new legislation such requests must be complied with free of charge, unless "manifestly unfounded" or "excessive".

Dr Richard Vautrey, BMA GP committee chair, said: "These findings reflect what we’d been hearing anecdotally for some time – that GP practices are facing a significant increase in the number of subject access requests now that GDPR legislation has come into force, meaning the double hit of an increase in work and a decrease in funding, at a time when most are already under enormous pressure.

"If practices are expected to meet the demand for these requests and practices are unable to charge a fee for reports to cover their costs, then the Government must provide funding, and we are actively pushing for this in ongoing contract negotiations."