Supporting people's rights, and staying trained

Data security is not only about keeping information in. It is also about giving people what is theirs.

Access requests

Patients and people we support have the right to see the information held about them. This is the right of access, exercised through a subject access request, and it is free of charge and normally answered within one calendar month. There are no formality rules: a request can be made in writing, by email, or out loud during a visit, to any member of staff. "Can I see what you write about me" is a valid request.

Your job on the front line is simple: recognise the request and pass it to the right person, your manager or data protection lead, the same day. Never ignore it, never say "that's not allowed", and never hand over a full record on the spot without process, because some material may need review first, in particular information about other people that appears in the record.

Families and representatives can make requests too, but their rights are not automatic. An adult with capacity must authorise someone acting for them. Where a person lacks capacity, an attorney or deputy may act, and requests are considered in the person's best interests. When in doubt, take the request and escalate it. And remember that behind most access requests is a person trying to understand their own care, or a family trying to understand what happened to someone they love. Handle them with respect, not defensiveness.

Rectification and beyond

People can also ask for inaccurate information to be corrected, and have other rights over their data, such as objecting to certain uses. Route these the same way: acknowledge, record, escalate.

Annual training

Data security training in health and care is annual, not once ever. That is a DSPT requirement, and it exists because threats change, tools change, and habits fade. Completing this course is part of that cycle: your certificate is valid for twelve months, after which a refresher keeps your knowledge, and your organisation's DSPT position, current. If anything in your day-to-day work does not match what you have learned here, that is worth a conversation with your manager. Noticing the gap is the point of the training.