Even if a GP has not received any training about how to deal with Subject Access Requests there is no if’s, but’s or maybe’s – they have the legal responsibility to decide if the information can be released, and if not, document the reasons why in their clinical opinion it should not be released.

Basic guidance is there from the BMA and other professional bodies but a Practice can and should make use of their Data Protection Officer.