Subject Access Requests

Individuals have certain rights regarding their personal data held within our collections. Subject to conditions set out by data protection law, individuals may:

• Request access to their personal information (known as a "Subject Access Request"). This enables the applicant to receive a copy of any personal information held about them and to check that it is being lawfully processed. • Request the transfer of their personal information to another party.

The process for handling a Subject Access Request varies depending on the access status of the material:

• When an enquiry comes in asking if we hold any records about the individual, ask them to search the catalogues, providing the normal guidance in order for the enquirer to narrow their request.

• Once they have narrowed their search to a specific record or series, if these are open or restricted, explain the normal procedures for registering as a library member and ordering the material.

• If they think their information might be in a specific series of closed records you can, at your discretion, do a quick search. For instance, many clinical files are catalogued alphabetically by surname, but the names are not included in the catalogue record. You can quickly check the physical files to see if the individual’s file exists to save them going through the formal subject access request process if there is nothing there.

• If you identify information in the files, or if checking would be prohibitively time consuming, refer the enquirer to the Subject Access Request process: they will need to make a written request to Wellcome’s Data Protection Officer (by email: [email protected] or by post: Data Protection Officer, Wellcome Trust, 215 Euston Road, London NW1 2BE, UK)and provide proof of identity.

• If a subject access request is made, assist the Data Protection Officer by retrieving the required records on green slips and inform RMR desk staff that the Officer will be looking at closed material.

• The Data Protection Officer is permitted to make copies of the records, but all material should remain in the RMR.

Please see section 3.4 of the Access to Sensitive and Personal Information in our Collections policy for more information.