Under the General Data Protection Regulation (GDPR) you have the right to request a copy of the personal data that we hold on you.
When you make a request, you need to include:
- your completed form - forms are linked below
- a copy of government-issued photo ID, such as your passport, driving licence, public services card
- a signed letter of authority or consent (if you are applying for another person's data)
Requesting access to your personal data
You can ask for a copy of your personal and health data including:
- records of your treatment
- test results
- notes made by healthcare professionals
How to request your personal data from the HSE
Complete the Subject Access Request form (PDF, 77 KB, 1 page).
When you complete the form, include:
- your contact details
- a detailed description of the personal data you want to access
- the dates when you used our services
- locations involved
- department of service involved - for example Emergency Department, St. James' Hospital
The more information you can provide on the locations, the better.
If you apply for someone else, you need to provide written consent from the person - such as a signed letter.
Request for correction
You can ask for your personal data to be corrected if it’s wrong or incomplete. This is known as the right to rectification.
You can request changes to things such as your name, date of birth or address.
We cannot change a medical opinion based on a request. This is because doctors use their professional expertise to make a diagnosis.
The right to rectification is not an automatic right. It only applies in certain cases.
How to ask for your personal data to be corrected
Complete the Request for rectification form (PDF, 273 KB, 4 pages)
When you complete the form:
- outline what personal data is inaccurate
- include your contact details
Someone else can apply for this information, for example, a solicitor or family member.
If you apply for someone else, you need to provide written consent from the person - such as a signed letter.
Request for erasure
You have the right to ask for your personal data to be deleted. This is known as the right to erasure or the right to be forgotten under GDPR.
The right to erasure is not an automatic right and only applies in certain cases.
How to ask for your personal data to be deleted
Fill out the Request for erasure form (PDF, 271 KB, 4 pages)
When you complete the form:
- clearly describe what personal data you want deleted
- explain why you want the your data removed
- include your contact details
Someone else can apply for this information, for example, a solicitor or family member.
If you apply for someone else, you need to provide written consent from the person - such as a signed letter.
For more information on when these rights apply, see the FAQs on dataprotection.ie
Sending your request
You need to include:
- your completed form
- a copy of government-issued photographic identification, such as your passport, driving licence, public services card
- a signed letter of authority or consent (if someone else is applying for you)
Send these by email or post to the relevant regional data protection office, depending on the location of the service or facility.
Contact regional data protection offices
Getting a response
We aim to respond within 1 month.
We will tell you if we:
- completed the request
- could not complete the request and the reason why
- need more time to complete the request and the reason why
- need to charge a fee to process the request and the reason why
In complex cases, it may take an additional 2 months to complete a request.
Fees
GDPR requests are normally free.
We can charge a fee if the request is excessive. For example, making repeated requests for the same data.
We will tell you the reason for the fee and about your right to complain to the Data Protection Commission.