The ICO has fined a care home director £6,000 for failing to comply with a lawful Subject Access Request.
Andy Curry, Head of Investigations at the ICO said
“We describe subject access requests as a fundamental right. This is because it helps people understand how and why organisations are using their information. This family put their trust in Bridlington Lodge Care Home to look after their father, and they had a right to receive information about his care.
“By ignoring this request for personal information and refusing to provide any explanation, Mr Blake believed he was above the law. Not only did he dismiss the family’s request, he also tried to avoid scrutiny by asking the ICO to cancel his registration.
“I hope this successful prosecution reminds all organisations that data protection applies to everyone, and subject access requests must be handled lawfully and responsibly.”
You can read the full ICO notice at https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/09/care-home-director-found-guilty-of-ignoring-request-for-personal-information/ but what are the lessons for us all?
You must never ignore a lawful Subject Access Request, or any of the UK GDPR subject requests (object to marketing, erasure, rectification, etc).
So is your data subject rights policy up to date, and do your staff know how to recognise and action the different types of request?
If you are unsure, then why not get in touch so that we can help you stay safe in this important area?