Subject Access Requests – The 30-Day Sprint

Subject Access Requests (SARs) continue to rise as patients exercise their data rights. Treating each request as a 30 day sprint keeps everyone focused, ensures evidence of compliance, and highlights where premium toolkits can add automation.

Map the sprint timeline

• Day 0: Acknowledge receipt, validate identity, and clarify scope with the requester if anything is unclear.
• Day 1 to 7: Gather records from clinical systems, email, third party providers, and archived media; log every source.
• Day 8 to 20: Review the material, apply exemptions, redact third party information, and document decisions in the case log.
• Day 21 to 25: Carry out quality checks to ensure the response matches the request and that redactions are consistent.
• Day 26 to 30: Dispatch securely, record the delivery method, and capture feedback or follow up actions.

Assign roles and responsibilities

• SAR coordinator: Owns the deadline, maintains the tracker, and keeps requesters updated.
• Clinical reviewer: Confirms context, applies exemptions, and approves release of clinical information.
• Administration support: Collates records, monitors progress, and documents communications with the requester.

Put essential controls in place

• Use a visible Kanban board or case management tool so every request is tracked through each stage.
• Maintain redaction guidelines covering common sensitive categories such as third party references or safeguarding notes.
• Prepare templated letters for clarification requests, extensions, and completion notices to keep messaging consistent.

Measure performance and improvement

• Track the percentage of SARs acknowledged within 48 hours and completed within 30 days.
• Monitor cycle time per stage to identify bottlenecks in collection, review, or approval.
• Record reopened cases or complaints about SAR handling and feed lessons into process changes.

Take the next step

Review your last three SARs, plot them against the sprint timeline, and identify the slowest stage. Agree one improvement, such as updating redaction guidance or expanding the tracker. Use the findings to introduce premium templates, automation scripts, or training modules when the team is ready for more support.

Disclaimer

This guidance is for general information. It is not a substitute for legal, clinical, or specialist advice. Always seek professional support tailored to your practice.