Information Commissioner calls for organisations to create better records together

Dear leader,

In 2025, thousands of people will have attempted to access their care records via a subject access request (SAR).*

This is more than a request for personal information – these are people who want to access their own story.

But for far too many, that request becomes a fight.

71% struggled with poor communication from the organisation.
69% say the request took longer than expected, with one person still waiting 16 years later.
Nearly nine in 10 were left with questions or concerns.

I am writing to urge your organisation to improve your approach today.

The current picture

My office has surveyed over 200 people to understand the challenges faced when making requests for care records. People told us of a lengthy, demoralising and often traumatic process – which can lead to distrust towards the organisation. Their requests have been met with cold bureaucracy, long delays and pages of unexplained redactions.

When care records were received, over half (59%) did not receive enough information, and only half understood that some information may be redacted.

We have also spoken to front-line staff across the UK, who are trying their best to get this right. They expressed real concern where they felt that their service was failing people, but often struggle with lack of resources, clear guidance and senior support.

Your legal responsibilities

The Data Protection Act sets out clear legal requirements around how organisations must handle these requests. You must respond without undue delay and within the statutory timeframe. Personal information must be stored securely and protected against loss, damage, or destruction.

It is your job to ensure you comply with the law and implement good practice measures to reduce harm. We have created tools to help you to do that. But if you fail to comply, my office will take action.

We recently served Bristol City Council with an enforcement notice for undue delays involving child social care data, and we fined Scottish charity Birthlink £18,000 after it destroyed thousands of records, including handwritten letters and photographs.

Files were my story and childhood

This is more than just legal duty – there is a person at the heart of each request.

One young person told us about their year-long battle to access some of their care records from their local authority. Without appropriate care and support, they had to turn to therapy to cope with the emotional impact.

“I was told that my records were 'destroyed in error' after I complained about being abused in care. Those files were not just paperwork; they were pieces of my story and childhood. They should have contained evidence of what happened to me. If they’d just got it right, so much trauma could have been prevented.”

Improvements we expect

Today, we have launched our ‘Better records together’ campaign by publishing a suite of new resources to help you get this right.

With our support, you must urgently improve how your organisation handles these requests:

Implement the measures in our standards as a priority – your front-line staff must understand how to handle requests with care and communicate with empathy.
Put sufficient resources in place – ensure you can manage the volume and complexity of requests without delay and further harm.
Invest at the very start of the care records lifecycle – build records with good practice and people’s rights in mind to reduce future challenges.

Visit our website to access the resources and further support.

This will continue to be a priority for my office, as we work with organisations to make improvements and take action when change does not happen.

John Edwards, Information Commissioner

*Stat referenced in CoramBAAF report.