Care Shield Compliance Press Desk

ICO will now enforce against slow subject access requests

The ICO says it will prioritise enforcement against persistent subject access delays, after a pilot found people waiting up to 16 years for records.

By the Care Shield Compliance Press Desk··3 min read·UK-wide

The Information Commissioner's Office has said it will prioritise enforcement action against organisations with persistent delays in SAR responses and a lack of measures to reduce harm and address delays. That is a stated enforcement priority, not general guidance. If your subject access process runs late as a matter of routine, you are now inside a named risk category.

What the ICO published

On 21 August 2026 the ICO launched a three-minute video, My right to better records, supporting its Better Records Together campaign. The announcement is on the ICO site.

Alongside it, findings from a supervision pilot covering 19 organisations across 2025-2026:

  • 89% of people accessing records were left with questions or concerns.
  • 71% experienced poor communication from local authorities.
  • 69% reported longer-than-expected processing times, with some waiting up to 16 years.

Sixteen years. That figure describes care records requests from care-experienced adults seeking their own childhood histories, and it explains why the ICO has moved from encouragement to enforcement language.

The enforcement record so far

The ICO has already acted. Reprimands went to Glasgow City Council and City of Edinburgh Council in February 2025. An enforcement notice was issued to Bristol City Council in September 2025. In July 2025 the charity Birthlink was fined £18,000 for destroying approximately 4,800 records.

That last one is the warning most relevant to providers. The fine was for destruction of records, not for delay. Retention schedules applied mechanically to records that people have a lifelong interest in are a live enforcement risk.

Why this reaches care providers

Much of the pilot concerns local authorities, but the records themselves frequently sit with providers. When a care-experienced adult or a family member requests records, the request often lands on you.

Three failure modes are common. Requests arriving by unusual routes — a phone call, a comment to a care worker, an email to a generic inbox — and never being recognised as SARs. Third-party information in care records being handled by guesswork. And archived paper records from closed services that nobody can locate within the statutory period.

What this means for you

  • Test your own timeline. Take the last five SARs you received and check the date the request first reached anyone in your organisation against the date you responded. The clock starts at first contact, not at recognition.
  • Train frontline staff to recognise a request for records however it arrives, and give them a single route to pass it to.
  • Review your retention schedule against the Birthlink case. Before destroying anything relating to someone's care history, check whether the person has an enduring right to it.
  • Know where your archives are, including records from services you have closed or acquired. If you cannot locate them, you cannot meet a deadline.
  • Communicate during the process. The pilot found 71% experienced poor communication and 89% were left with questions. Delay plus silence is what the ICO says it will pursue.
  • Offer support with the content, not just the disclosure. Care records are frequently distressing to read.

Care Shield cannot make a record appear that was never kept, but knowing where your records are and when each request landed is the part of this that is genuinely a systems problem.

Where this came from

The ICO's announcement of its My right to better records video, 21 August 2026.

ShareLinkedInXFacebookWhatsAppEmail

Sources

  1. New video to help care-experienced people understand their rights around accessing care records — Information Commissioner's Office

Questions people ask about this

When does the SAR clock actually start?

When the request first reaches your organisation, not when someone recognises it as a subject access request. A phone call to reception or a comment to a care worker can start it. Train frontline staff to identify and escalate requests immediately, and log the date of first contact rather than the date of internal handover.

Are we at risk if we follow our retention schedule?

Possibly. The ICO fined Birthlink £18,000 in July 2025 for destroying approximately 4,800 records. Mechanical application of a retention schedule to records that someone has an enduring personal interest in — particularly care histories — is a genuine enforcement risk. Review your schedule specifically against that scenario.

What matters as much as meeting the deadline?

Communication. The ICO's pilot found 71% experienced poor communication and 89% were left with questions or concerns after accessing records. The stated enforcement priority covers both persistent delays and a lack of measures to reduce harm, so keeping people informed and supported through the process is part of compliance, not a courtesy.

How this was written. Care Shield’s press desk drafts from primary sources — the statute book, regulator publications and government announcements — and publishes automatically once every factual claim traces to a named source. The sources are listed above so you can check them. It is not legal advice, and it is not a substitute for reading the regulation that applies to your service. If you find something wrong, tell us at hello@careshieldcompliance.co.uk and we will correct it in public, on this page.

Related