August 21, 2026. The ICO quietly published a new video resource explaining the rights of care-experienced individuals to access their records, and most private clinic owners will have missed it entirely.
That's understandable. The ICO publishes constantly, and a video aimed at care-experienced people doesn't immediately sound like something that affects an aesthetics clinic in Leeds or a private GP practice in Bristol. But the right it describes sits inside UK GDPR, which does apply to you, and the access request it covers is one your reception team probably isn't ready for.
What "care-experienced" actually means here
The ICO's guidance covers people who have spent time in local authority care: looked-after children, those placed with foster families, people who lived in children's homes, and care leavers. In England alone, there were around 83,000 looked-after children at the end of 2025, according to the Department for Education's annual statistics. Many of them will grow up and, at some point, want to understand their history. That includes health records.
A care-experienced adult might contact your clinic because they were treated there as a child. They might not know who their GP was, or even their own date of birth with certainty. They might be trying to piece together a past that was fragmented. The request they submit is a Subject Access Request under UK GDPR, the same legal mechanism as any other SAR, but the context around it is different, and how your team handles it matters.
The same law, a harder situation
You have one calendar month to respond to a SAR. That hasn't changed. What the ICO's video resource highlights is that care-experienced people face particular barriers when making these requests: gaps in their own information, uncertainty about which organisation holds what, and sometimes significant emotional weight attached to the process.
None of that changes your legal obligation, but it does change what a reasonable response looks like in practice. If someone writes to you and says they don't know their date of birth, your team shouldn't simply reject the request because they can't locate a record. Article 12 of UK GDPR requires you to respond in a "concise, transparent, intelligible and easily accessible form." That means helping the person understand what you can and can't find, not just telling them nothing came up.
The ICO has been clear in previous guidance that controllers should take "reasonable steps" to identify data subjects even when the information provided is incomplete. The video reinforces this expectation specifically in the context of care records.
Where private clinics are most exposed
Most private clinics are not thinking about this. Their SAR process, if they have a written one at all, probably assumes the requester knows their full name, address, and date of birth. It probably assumes the request is straightforward.
A few scenarios worth thinking through:
- A care leaver contacts you having been treated at your clinic between the ages of eight and twelve. They have a rough time period and a previous surname they're not sure about.
- Someone contacts you saying their care records from a children's home mentioned a referral to your practice, but they have no other details.
- A solicitor acting for a care-experienced adult writes requesting all records your clinic holds, with limited identifying information.
Your team needs to know what to do in each case. "We couldn't find anything" sent after a two-minute search probably isn't a reasonable response.
What to actually do this week
The ICO video is worth watching if you're the person who owns data compliance at your clinic. It's aimed at care-experienced individuals rather than data controllers, which makes it useful: it shows you what someone in that situation has been told to expect, and where the process is likely to get difficult.
Beyond that, a few practical steps:
Review your SAR procedure for incomplete identification. Does it tell staff what to do when someone can't provide a full name or date of birth? If not, add a step. The guidance should say: search on partial information, document what was searched, record what was found and not found, and respond explaining the outcome clearly.
Check how long your clinic retains paediatric records. The NHS recommends retaining records for patients who were children until they turn 25, or for eight years after the last entry if that's longer. Private clinics aren't automatically bound by NHS retention schedules, but the ICO would expect you to have a written retention policy and to actually follow it. If you're destroying records earlier than that, you may want to revisit the decision.
Train whoever answers the phone and manages your inbox. A care-experienced person making this kind of request may have had poor experiences with institutions before. The way a request is initially received matters. Staff should know to take it seriously, not to dismiss it because it seems complicated, and to escalate it rather than handle it informally.
Write down what you do. If the ICO ever asks how you handled a SAR from a care-experienced individual, you want a paper trail showing that you took reasonable steps, searched appropriately, and communicated clearly. If you're using practice management software to handle SARs, make sure there's a record of the request, the search, and the response. HealSuite logs SAR activity against patient records, which helps if you ever need to demonstrate compliance after the fact.
One thing that's genuinely uncertain
The ICO hasn't published separate formal guidance for private healthcare providers on care-experienced requests specifically. The video resource is one piece of a broader set of materials aimed primarily at the individuals themselves. Whether the ICO considers a short video aimed at data subjects sufficient notice to controllers is, frankly, a reasonable question.
My reading is that the underlying obligations aren't new. UK GDPR's requirements on SARs, partial identification, and intelligible communication have been there since 2018. The video doesn't create new law. But it does signal that the ICO is paying attention to this group, and if your response to a SAR from a care-experienced person is inadequate, the fact that you hadn't seen the video won't help you.
The more honest answer is: if your SAR process is solid in general, you're probably not far off. If it's a laminated sheet on a wall that nobody has read since the practice manager left in 2023, that's the actual problem to fix.