NHS Subject Access Request Pack

A request to the data protection officer for a copy of all your personal data and the related information, with a schedule, your preferred format, and asks about ID, clarification, extensions, redaction and fees.

[Your address]
[Your email address and phone number]

14 October 2026

Data Protection Officer
Example NHS Foundation Trust

Dear Data Protection Officer,

Subject: Subject access request - Sam Okafor

I am making a subject access request under the UK GDPR and the Data Protection Act 2018. I am asking for a copy of all the personal data you hold about me, together with the other information I am entitled to.

I work for Example NHS Foundation Trust as Senior Physiotherapist.
My staff number is EX123456.

Please provide:
1. a copy of my personal data, whether it is held on paper or electronically; and
2. the related information: the purposes for which you use my data, the categories of data, who it has been or will be shared with, how long it will be kept, where it came from if not from me, my rights to ask for correction, deletion, restriction or to object, my right to complain to you and to the Information Commissioner, whether any automated decision-making or profiling is used, and the safeguards for any transfer outside the UK.

To help your search, I have set out in the attached schedule where I expect my data to be held. The schedule is to help you and does not limit this request.

In summary, I expect my data to be held in these places: my personnel or HR file, the Electronic Staff Record (ESR) and HR systems, pay and payroll records, investigation, disciplinary, grievance, capability or appeal files and emails, messages and chat that mention me.

Period: from 1 January 2023 to the date of your reply.

If it would help you to provide the information in stages, the items I need first are: the investigation file and the terms of reference. I still ask for everything else.

I am aware that an investigation or disciplinary process is under way. This request is made in its own right under the UK GDPR. I ask that it is answered as a subject access request, and not treated as answered by documents provided in that process.

I would like the information as a secure electronic copy, such as encrypted email or a download link.

I would be grateful if you would:
- acknowledge receipt, and tell me who is dealing with my request;
- tell me promptly if you need proof of my identity, and what you will accept, because I understand the one-month time limit runs from when you have it;
- tell me promptly if you need me to clarify any part of the request, saying which part and why;
- if you intend to extend the time limit because the request is complex, tell me within the first month and explain why;
- if you withhold or redact anything, tell me what and why, and tell me about my right to complain to you and to the Information Commissioner and to ask a court to enforce my rights; and
- tell me before doing the work if you think any fee applies, and explain why.

I understand the time limit is one month from receipt, to the corresponding date next month. I look forward to your reply by [date].

Thank you.

Yours sincerely,

Sam Okafor

[Proof of identity enclosed or available: delete if not needed]
[Attached: schedule of information requested (document 2)]
[cc: my trade union representative: delete if not needed]

[Delete before sending: you do not have to give a reason. The ICO says that wanting the information for a grievance or tribunal is not by itself a reason to refuse. Send it to the address in the trust's privacy notice, by a method that proves the date it arrived, and keep a copy. The ICO also runs an online service that emails a request to an organisation and sends you a copy. Count the month from the day the trust receives it.]

[Delete this line before sending: check every bracketed item, check your trust's own policy and have your union or staff-side rep read it first.]

A schedule to attach to the request: the records you expect, specific documents, who and what to search, and a private note on what is realistic for each kind of record.

SCHEDULE OF INFORMATION REQUESTED: Sam Okafor
Attached to my subject access request of 14 October 2026. Prepared 14 October 2026.

[This schedule helps the trust search. It does not limit your request, which is for all your personal data. You do not have to ask for everything below: remove anything you do not want.]

Applicant: Sam Okafor, Senior Physiotherapist, Example NHS Foundation Trust
My staff number is EX123456.
Period: from 1 January 2023 to the date of your reply.

A. Where I expect my personal data to be held
1. My personnel or HR file, including my contract, offer and variation letters, probation and review records, and correspondence with HR about me, whether held on paper or electronically and wherever it is kept.
2. My record on the Electronic Staff Record (ESR) and any other HR or workforce system, including employment history, grade, pay point and pay step details, absence and training entries, and any notes, flags or comments on the record.
3. My pay and payroll records, including payslips, pay point and pay step history, overtime and additional hours claims, expenses, deductions, overpayment or recovery records, and any queries about my pay and the replies.
4. Every investigation, disciplinary, grievance, capability, appeal or other formal process file that concerns me, including terms of reference, investigation reports, witness statements, meeting notes and recordings, correspondence, panel notes and decision letters.
5. Emails, text and chat messages, Teams or similar messages and notes of conversations that contain my personal data, sent or received by the people and teams listed below, or held on the trust's systems.

B. Specific documents or events I know about
1. Notes of the investigation interview with me (September 2026).
2. The terms of reference for the investigation (August 2026).

C. Who and what to search
- Roles or teams likely to have emails, notes or messages that mention me: Therapy services manager, HR adviser, investigating officer.
- Words likely to find relevant material: outpatient physiotherapy team, case review 2026.
- Systems likely to be involved: [for example email, HR system, ESR, payroll, rostering, shared drives, Teams or chat, paper files in the department]

D. Please also include
- Information held by anyone processing it for the trust, including payroll, occupational health or HR services provided by another organisation.
- Notes, comments and opinions about me, including handwritten notes and notes of meetings.

E. Realistic expectations (for you; delete before sending)
- Personnel or HR file: Usually the easiest to find, but it may be split between a paper file in a department and a system held by HR. Name both. References you were given or that were given about you may be treated as confidential: the ICO says confidential references can be exempt, so do not be surprised if one is missing.
- Electronic Staff Record (ESR) and HR system entries: ESR is the NHS Electronic Staff Record that many trusts use for HR and payroll data. Ask what is held on it and in what form. A printout of screens may not be the clearest format, so say how you would like it provided.
- Pay and payroll records: Payroll may be run by the trust or by a separate shared service. If so, say that you want both the trust's and the provider's records and ask the data protection officer to pass the request on if needed.
- Investigation, disciplinary, grievance, capability or appeal files: You are entitled to your personal data, not necessarily to whole documents. Witness names and other people's details are often redacted. The ICO describes a balancing test for witness statements. Expect redaction rather than a flat refusal, and ask for an explanation of what was removed.
- Emails, messages and chat that mention me: The ICO says only the parts of an email that are your personal data have to be provided, so a message that merely copies you in may not count. Naming the roles or teams and the period, and a few search words, makes a reasonable and proportionate search easier for the trust. You cannot be forced to narrow the request.
- You are entitled to your own personal data, not to every document that mentions you. Expect some redaction of other people's details, and ask for an explanation of what was removed and why.
- The ICO says an organisation need only make a reasonable and proportionate search. Naming where to look makes that search easier.
- Legal advice, some confidential references, and some planning or negotiation material can be withheld in some circumstances. Ask the trust to say what it has withheld and why, so you can judge it.

[Delete this line before sending: check every bracketed item, check your trust's own policy and have your union or staff-side rep read it first.]

Three short letters: a chaser after a month, a reply when the trust says it needs longer, and a reply when it asks for ID or clarification.

FOLLOW-UP LETTERS: 14 October 2026

Which one: Keep these for after you have sent your request. Letter A is the first you may need, from one month after the trust received it.

========== LETTER A: chaser (no reply after a month) ==========
[Your address]

14 October 2026

Data Protection Officer
Example NHS Foundation Trust

Dear Data Protection Officer,

Subject: Subject access request of 14 October 2026 - Sam Okafor - no response

I made a subject access request on 14 October 2026, which you received on [date received / delivery confirmation]. I have not received [a response / a response to the whole of my request].

The ICO's guidance says that organisations should respond without undue delay and within one month of receiving a request, and that the person can chase if the month has passed. [Add: I have not been asked for proof of identity or for clarification.]

Please can you:
- confirm that you hold my request, and who is dealing with it;
- provide the information I asked for, or tell me by [date] when you will; and
- if you say you have extended the time limit, tell me why and from what date.

If I do not hear from you by [date, for example 14 days from today], I will consider raising a complaint with your data protection officer and, if that does not resolve it, with the Information Commissioner.

Yours sincerely,
Sam Okafor

========== LETTER B: the trust says it needs longer ==========
[Your address]

14 October 2026

Data Protection Officer
Example NHS Foundation Trust

Dear Data Protection Officer,

Subject: Subject access request of 14 October 2026 - Sam Okafor - extension

Thank you for your letter of [date] saying you need longer to respond to my subject access request.

I understand the time limit can be extended by up to two further months where a request is complex or someone has made several requests, and that I must be told the reasons within the first month. Please can you tell me:
- why you consider my request to be complex, or what other requests you are counting;
- the date by which you now expect to respond; and
- whether any part of the information can be provided sooner. [Optional: the items I need first are ...]

Yours sincerely,
Sam Okafor

========== LETTER C: the trust asks for identity or clarification ==========
[Your address]

14 October 2026

Data Protection Officer
Example NHS Foundation Trust

Dear Data Protection Officer,

Subject: Subject access request of 14 October 2026 - Sam Okafor - your questions

Thank you for your message of [date].

[If they asked for identity:] I enclose [document] as proof of who I am. Please confirm the date you received it, because I understand the one-month time limit runs from then.

[If they asked for clarification:] My request is for all of my personal data. I am not required to narrow it. To help you, the places I most expect to find it are in the schedule I sent, and the items I need first, if you want to provide it in stages, are [items]. Please confirm the date you received this reply and that my request is now being dealt with in full.

Yours sincerely,
Sam Okafor

[Delete before sending: the ICO says the clock is paused from the day the trust asks to clarify until the day after you reply, and that the trust should only ask when it is reasonably needed. The month may start later if it asked for ID. Ask the trust to confirm the new response date in writing.]

[Delete this line before sending: check every bracketed item, check your trust's own policy and have your union or staff-side rep read it first.]

A letter naming what is missing or unexplained, asking for a fresh search, the reasons for any exemption and a reply within a calendar month, and citing the 30-day acknowledgement duty.

[Delete before sending: this is for after you have had a response you are unhappy with, a refusal, or no response at all. The ICO says to give the trust a chance to put things right first. If you have had no reply, send Letter A in document 3 first.]

[Your address]
[Your email address and phone number]

14 October 2026

Data Protection Officer
Example NHS Foundation Trust

Dear Data Protection Officer,

Subject: Complaint about my subject access request of 14 October 2026 - Sam Okafor

I am complaining about the way you have dealt with my subject access request of 14 October 2026. I work for Example NHS Foundation Trust as Senior Physiotherapist.

What happened
- I made my request on 14 October 2026. [Delete if not needed: the trust acknowledged it on (date).]
- On [date] I received [a response / part of the information / a refusal / nothing].
- More detail: [describe the problem in your own words]

What I think is missing or has not been explained
1. [Name the specific information you think is missing, or the redaction or refusal you want explained. The ICO suggests naming the particular documents or emails.]

What I am asking you to do
- search again for the information listed above, and tell me where you looked;
- provide it, or if you are withholding any of it, tell me exactly what, which exemption or reason you rely on, and why it applies in my case;
- explain any redactions;
- give me the related information I asked for about purposes, recipients, retention and my rights, if it was not provided; and
- reply in full within one calendar month of this letter, or tell me when you will.

I understand that section 164A of the Data Protection Act 2018 requires a data controller to acknowledge a complaint within 30 days and to respond to it without undue delay and tell me the outcome. Please acknowledge this letter and tell me who is dealing with it.

I would like a copy of your complaints procedure. If this is not resolved, I may complain to the Information Commissioner.

Yours sincerely,

Sam Okafor

[Enclosed: copy of my request and schedule; copy of your response; any earlier correspondence. Delete what does not apply.]
[cc: my trade union representative: delete if not needed]

[Delete before sending: the ICO says to complain to the organisation first, preferably by email; to name the specific information you think is missing; to keep copies of all correspondence and notes of calls; and to give the organisation a calendar month to answer. Say plainly what you want. Do not accuse anyone of breaking the law: ask for the explanation.]

[Delete this line before sending: check every bracketed item, check your trust's own policy and have your union or staff-side rep read it first.]

A structure for complaining to the Information Commissioner: parties, a dated timeline, what you think is wrong, steps taken, documents to send and what to leave out.

ICO COMPLAINT: OUTLINE (14 October 2026)

[This is an outline to help you fill in the ICO's own complaint form or write to the ICO. It is not the form. Use the ICO's website for how to complain, and check what it asks for. The ICO says to try the organisation first, and to complain within three months of your last meaningful contact with the organisation. The ICO cannot act as your representative or award compensation.]

1. Who I am complaining about
- Organisation: Example NHS Foundation Trust
- Data protection officer or contact I wrote to: Data Protection Officer
- My name: Sam Okafor, Senior Physiotherapist

2. What happened, in date order
- 14 October 2026: I made a subject access request. [Method: by email to the address in the privacy notice. Proof of delivery: ...]
- [date]: [what the trust sent, or that nothing arrived]
- [date]: I complained to the trust. [Their reply, if any: ...]
- [date]: the trust's last meaningful contact with me.

3. What I think is wrong
- [Say in plain words what you think the trust has not done: for example, not responded, not provided a category of information, not explained a redaction.]
- In my own words: [one or two sentences]

4. What I have already done to put it right
- Request letter and schedule (documents 1 and 2).
- Chaser or complaint to the trust (documents 3 and 4), with their replies.
- [Anything else: calls, meetings, union involvement.]

5. What I would like the ICO to look at
- [For example: whether the trust has responded to my request, and whether the information it withheld or redacted was explained.]

6. Documents to send (copies, not originals)
- My request and the schedule, with proof of when it was sent and received.
- The trust's response, however partial, with the envelope or email showing the date it arrived.
- My complaint to the trust and any reply.
- A short timeline (section 2 above).

7. Things not to include
- Do not send documents containing other people's personal data unless you need to. Black out names that are not yours to share.
- Do not send a long account of the whole dispute at work. Keep to the request and what the trust did.

8. After you send it
- Keep a copy and note the date. The ICO says it will tell you the outcome of its assessment. If the ICO cannot help, a court is another route, and the ICO advises taking independent legal advice first.

[Delete this line before sending: check every bracketed item, check your trust's own policy and have your union or staff-side rep read it first.]

A sheet to check what arrived against what you asked for, the related information, redactions and errors, and what to do next.

RESPONSE CHECKLIST: Sam Okafor
Request sent 14 October 2026. Prepared 14 October 2026.

[Use this when information arrives, so you can see what is there and what is not. Tick or write in the brackets.]

1. Dates
- Request sent: 14 October 2026
- Trust received it (proof): [date and how I know]
- Acknowledged: [date, or not acknowledged]
- Asked for ID or clarification: [date and what, or no]
- Told me it needed longer (and why): [date, or no]
- First information received: [date]

2. What I asked for against what arrived
- Personnel or HR file: [arrived in full / partly / not at all] [notes]
- Electronic Staff Record (ESR) and HR system entries: [arrived in full / partly / not at all] [notes]
- Pay and payroll records: [arrived in full / partly / not at all] [notes]
- Investigation, disciplinary, grievance, capability or appeal files: [arrived in full / partly / not at all] [notes]
- Emails, messages and chat that mention me: [arrived in full / partly / not at all] [notes]

3. The related information (should be in or with the response)
- Purposes: [given / not given]
- Categories of data and who it was shared with: [given / not given]
- How long it is kept: [given / not given]
- Where it came from, if not from me: [given / not given]
- My rights to correction, deletion, restriction and objection: [given / not given]
- My right to complain to the trust and to the ICO: [given / not given]
- Automated decisions or profiling, and transfers abroad: [given / not given]

4. Read what arrived
- Is anything I know exists missing? [what, and where it should be]
- Are there documents mentioned in other documents that were not included? [list]
- Is there anything redacted? Was I told why? [list pages]
- Is anything wrong or out of date in my record? [list: you can ask for correction]
- Is anything missing that you expected from an email or message search? [what]

5. What to do next
- All there: keep a secure copy, and use it for what you need.
- Something missing: name it in a complaint to the trust (document 4).
- Something wrong: ask for the record to be corrected in writing, saying what is wrong and what it should say.
- Not sure: ask your union rep, or your trust's data protection team, or phone the ICO.

6. A note on keeping what you receive
- It is your personal data, but may contain other people's details. Store it securely, do not share it more widely than you need to, and do not post other people's details online.

[Delete this line before sending: check every bracketed item, check your trust's own policy and have your union or staff-side rep read it first.]