Cookies on the NHS Newark & Sherwood CCG website

We use cookies to ensure that we give you the best experience on our website.

To continue using the website you are indicating that you are happy to receive all cookies on our site.

Continue Find out more

Request your personal information - Data Protection Act

If you wish to obtain information under the Data Protection Act 1998, please send your request by email to: 

NHS Mansfield and Ashfield Clinical Commissioning Group -  

NHS Newark and Sherwood Clinical Commissioning Group -  

Or by post to:

Data Protection Act Requests

NHS Mansfield and Ashfield Clinical Commissioning Group

NHS Newark and Sherwood Clinical Commissioning Group
Birch House
Ransom Wood Business Park
Southwell Road West


Can I access my personal information?

You have the right to get a copy of the information that is held about you.  This is known as a subject access request.

This right of subject access means that you can make a request under the Data Protection Act to any organisation processing your personal data.  The Act calls these organisations ‘data controllers’.

You can ask us to supply you with copies of both paper and computer records and related information.

We may charge a fee of up to £10.

The following table shows the maximum fees for printing costs:

Number of pages of information supplied

Maximum fee





































However, it is important to remember that not all personal information is covered and there are ‘exemptions’ within the Act which may allow us to refuse to comply with your subject access request in certain circumstances.


Can I access personal information about my child?

Information about children may be released to a person with parental responsibility. However, the best interests of the child will always be considered.

Even if a child is very young, data about them is still their personal data and does not belong to anyone else.  It is the child who has a right of access to the information held about them.

Before responding to a request for information held about a child, we will consider whether the child is mature enough to understand their rights.  If we are confident that the child can understand their rights, then we will respond to the child rather than the parent.  What matters is that the child is able to understand (in broad terms) what it means to make a subject access request and how to interpret the information they receive as a result of doing so.


Can I access personal information on someone else’s behalf?

The Data Protection Act does not stop you making a request on someone else’s behalf.  This is often necessary for a solicitor acting on behalf of a client, or it could simply be that an individual wants someone else to act for them.

In these cases, we will need to satisfy ourselves that the third party making the request has the individual’s permission to act on their behalf.  It is the third party’s responsibility to provide this evidence, which could be a written authority to make the request, or a power of attorney.

If a person does not have the mental capacity to manage their own affairs and you are their attorney, for example you have a Lasting Power of Attorney with authority to manage their property and affairs; you will have the right to access information about the person you represent to help you carry out your role. The same applies to a person appointed to make decisions about such matters:

  • In England and Wales, by the Court of Protection;
  • In Scotland, by the Sheriff Court; and
  • In Northern Ireland, by the High Court (Office of Care and Protection).

Accessing and sharing information: Acting on behalf of a person with dementia


Can I access information about the deceased under the Data Protection Act?

The Act only applies to personal information about a living individual.  You may access information about deceased individuals through other legislation, such as the Access to Health Records Act.

Can I access the medical records (health records) of someone who has died?


How do I make a request?

To make a subject access request, follow these steps:

  • Plan ahead

It will save you time if you do the following before writing your request:

  • Make sure you know all the information you need.  We are entitled to charge a fee for every request, so you may have to pay another fee to get information you have not included in your original request.
  • Write to us

When requesting your personal information you should include the following information:

  • your full name, address and contact telephone number;
  • any information used by the organisation to identify or distinguish you from others of the same name (account numbers, unique ID's etc);
  • details of the specific information you require and any relevant dates, for example:
    - your personnel file;
    - emails between ‘A’ and ‘B’ (between 1/6/11 and 1/9/11);
    - CCTV camera situated at (‘E’ location) on 23/5/12 between 11am and 5pm.

It may also be helpful to include:

  • a reference to the 40-day deadline that applies when dealing with requests to provide personal information;
  • a reference to the Data Protection Act 1998 and subject access requests; and
  • reference to the assistance that the Information Commissioner’s Office can provide.

You also have the right to ask about any logic involved in any automated decisions made about you.

  • Keep copies and proof of receipt

It is best to send your request by recorded delivery or by email, and you should keep a copy of the request and all other correspondence.  This will be important as evidence if you need to complain to the Information Commissioner’s Office that we have not given you the information you think you are entitled to.


Do I have to make the request in writing?

A request sent by email or fax is as valid as one sent in hard copy.  You can also make a valid request by social media, for example via an organisation’s Facebook or Twitter account, although it will be impractical for us to use this same method to supply information to you.

If you find it impossible or unreasonably difficult to make a request in writing, we may have to make a reasonable adjustment for you under the Equality Act 2010 (or Disability Discrimination Act 1995 in Northern Ireland).  This could mean, for example, that we have to consider treating a verbal request for information as if it was a valid subject access request.

 For Rebate information, click here.

What can I expect from the organisation?

How should an organisation respond to my request?

We have to reply within 40 days, starting from the day we receive both the fee and the information we need to identify you and the information you need.

 If we reasonably need more information to find your information or identify you, we have to ask you for the information we need.  We can then wait until we have all the necessary information as well as the fee before dealing with your request.

 We should give you the information in writing but we need not do this if it is not possible, if it takes ‘disproportionate effort’ or if you agree to some other form, such as seeing it on screen.  The Act does not define what disproportionate effort means but we think the following should be taken into account:

  • the cost of giving you the information;
  • the length of time it will take;
  • how difficult it will be;
  • the size of the organisation; and
  • the effect on you of not having the information in permanent form.


What can I expect if I have rights under the Equality Act 2010 (or Disability Discrimination Act 1995 in Northern Ireland)?

Under equality law we have a duty to make sure that our services are accessible to all service users.  You can request a response in a particular format that is accessible to you, such as Braille, large print, email or audio format.

If you think that we have failed to make a reasonable adjustment, you can make a claim under the Equality Act (or Disability Discrimination Act in Northern Ireland).

Further advice is available from:

Equality Advisory Support Service (EASS) –; and

Citizens Advice –


What should an organisation send me?

You are entitled to be told if any personal information is held about you and if it is, to be given:

  • a copy of the information in permanent form;
  • an explanation of any technical or complicated terms;
  • any information the organisation has about where they got your information from;
  • a description of the information, the purposes for processing the information and who the organisation is sharing the information with; and
  • the logic involved in any automated decisions (if you have specifically asked for this).


Can the organisation withhold any information?

Yes.  There are some circumstances where the information you have asked for contains information that relates to another person.  Unless the other person gives their permission, or it is reasonable in all the circumstances to provide the information without permission, we are entitled to withhold this information.

The Act covers personal information that:

  • is held, or going to be held on computer;
  • is in, or going to be in, a manual filing system that is highly structured so that information about you can be easily retrieved;
  • is in most health, educational, social service or housing records; or
  • is other information held by a public authority?


What can I do if I believe we have not sent all the information I am entitled to?

If you feel we have withheld some of your personal information, we recommend you contact us with your concern. Make sure you state the information you think is being withheld.

If you have contacted us and still believe some of your personal information is being withheld, please contact the Information Commissioner’s Office via their live chat service or call their helpline on 0303 123 1113.


Your information

Information that has been held previously by NHS Rushcliffe, NHS Nottingham West, NHS Nottingham City, NHS Nottingham North and East, NHS Mansfield and Ashfield, and NHS Newark and Sherwood CCGS is transferring to the new CCG NHS Nottingham and Nottinghamshire CCG on 1 April 2020. The new CCG will become the new data controller. Any questions about the use of data (including patient data) by the new CCG should be directed to


NHS Choices
NHS England
Department of Health
disabled Go
Better Together
The NHS is 70 years old