Your Information and Rights
Your Information and Rights
This page will explain to you:
- What your individual rights are under GDPR
- How you can exercise those rights
- How to request your own information
- How to request the information of someone else
You can find more information on the Information Commissioners Office (ICO) website and in our documents.
Your rights
Under the General Data Protection Regulation (GDPR), you have Individual Rights which sets out how the Trust must manage your data. To exercise any of these rights please contact the Information Governance (IG) Team at nlft.information.request@nhs.net
Please see below for what these rights mean, what the Trust must do, and how we manage your rights:
| Individual Right | What this right means | How NLFT upholds individual rights |
| Right to be Informed | Individuals have the right to be informed about the collection and use of their personal data. | We detail the collection, use and processing of personal data in our Privacy Notices |
Right of Access |
Individuals have the right to access and receive a copy of their personal data, and other supplementary information. | You can request a copy of your personal data by making a Subject Access Request (SAR) |
| Right to Rectification | Individuals have the right to have their inaccurate personal data rectified, or completed if it is incomplete. | You can request rectification of your records by contacting the IG Team |
| Right to Erasure | Individuals have the right to have their personal data erased (this may not apply in every circumstance) | You can request erasure of your records by contacting the IG Team |
| Right to Restrict Processing | Individuals have the right to request the restriction or suppression of their personal data (this may not apply in every circumstance). | You can request restriction of the processing of your data by contacting the IG Team |
| Right to Object | Individuals have the right to object to the processing of their personal data in certain circumstances. | You can object to processing of your data by contacting the IG Team |
| Rights related to automated decision making including profiling |
Individuals have rights regarding automated individual decision-making (making a decision solely by automated means without any human involvement); and profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process. |
You can exercise rights relating to automated decision making by contacting the IG Team |
Accessing your information
You can request information that the Trust holds on you, such as your health records, by making a Subject Access Request (SAR).
You can make your SAR by emailing nlft.information.request@nhs.net
We would encourage you to fill out the below form when making your SAR as this will help us in narrowing exactly what information you require, however this is not a requirement:
Please note that requests for personal information may take between 30 — 90 days to respond to once identification is recieved, depending on the volume and complexity of the request.
Information and guidance on making a SAR can be found on the Information Commissioners Office website: Getting copies of your information (SAR) | ICO
Please supply identification when making your request, it would also be helpful to include your NHS number to address your request as efficiently as possible. Examples of acceptable proof of identification are listed below.
If you are unable to provide identification, please contact the IG Team at the above email address.
Accessing someone else's information
Under certain conditions, you can request the personal information of another individual. This is commonly known as a third-party request.
Third Party Request
To obtain the information of someone else, the Trust is required to validate your identity, and your connection to the individual whose information you are requesting.
When making a request for another persons information you must provide:
1. Your identity such as passport, driving licence or details of your organisation if relevant (such as law firm)
2. The details of the person you are requesting — their name, date of birth, NHS number
3. Proof that you have the consent of the person whose information you are requesting, or that you have the relevant authority to obtain information.
Proof of Authority/Consent
You must provide proof of authority and/or consent when asking for someone elses information. Depending on the circumstances of the request, examples of this evidence may include:
- Written consent which is signed and dated by the data subject. This consent must be legible and dated within the last three months.
- Letters from solicitors/legal representatives must provide consent on their firms letterheaded paper which is signed and dated within the last three months
- Third party material forms from the Police
- Court orders
Requesting information on a deceased person
You can request information on a person who has deceased through the Access to the Health Records Act. As above, you must provide adequate proof of identity and relationship in order to obtain this informaiton.
To access information on a deceased person please provide:
- Your identity such as passport, driving licence or details of your organisation if relevant (such as law firm)
- The details of the person you are requesting — their name, date of birth, NHS number, death certificate
- Proof that you are a personal representative of the deceased, or that you have permission of the personal representative. This should be in the form of a Grant of Probate or Letters of Administration.
- 4. If applicable, proof that you are an executor of the will or have a claim arising out of the deceased.
If you are unable to provide the relevant documents we will not be able to process your request, please contact the IG Team to discuss: nlft.information.request@nhs.net
More information on requesting information on a deceased individual is available here: Access to the health and care records of deceased people - NHS Transformation Directorate
