Understanding Your Rights and the Role of GP Practices When Applying for a Firearms Medical Certificate
When applying for a firearms or shotgun certificate through ShootCert, we request a copy of your full medical notes directly from your GP practice. This is known as a Subject Access Request (SAR)—a legal mechanism under the UK General Data Protection Regulation (UK GDPR) that allows individuals to obtain a copy of their personal data held by any data controller.
But what happens when you ask us to help obtain your records on your behalf? That’s where a third-party SAR request comes into play.
What Is a Third-Party SAR Request?
A third-party SAR request is when an organisation like ShootCert submits a SAR on behalf of a patient with their written consent. This is a common and lawful process, especially where the individual requires their medical notes for a specific purpose—such as obtaining a firearms medical certificate.
ShootCert is authorised to make SAR requests under the UK GDPR, provided we have the patient’s clear, written authority. This enables us to request the necessary medical information directly from your GP practice and receive it securely for review by our panel of doctors.
Why Use a Third-Party SAR?
There are several reasons why applicants use ShootCert to submit the SAR on their behalf:
Do GP Practices Have to Comply?
Yes. Under Article 15 of the UK GDPR, GP practices are legally required to provide an individual with a copy of their personal data upon request. The ICO (Information Commissioner’s Office) has made it clear that this obligation applies even when the SAR is submitted via a third party, as long as proper consent is given.
The requested data—your full medical record—must usually be provided within one calendar month, and free of charge in most cases.
When Might a GP Charge a Fee?
In certain circumstances, GP practices are permitted to charge a reasonable fee. This is only applicable if:
In practice, this might apply if your records span many decades, contain hundreds or thousands of pages, or if you’ve previously received your notes recently and are requesting them again without a good reason.
However, GP practices should not charge simply because the SAR is made by a third party like ShootCert. The law does not allow for charges just because the request is for a firearms certificate, nor is it acceptable to redirect applicants to preferred third-party providers or refuse to cooperate.
ShootCert’s View
We believe in fair access to your medical records. While we understand that some GP practices may incur admin time for fulfilling large SARs, we encourage transparency, timeliness, and compliance with the law.
If a GP practice tries to charge you a fee, we will help assess whether the fee is justified. We may also escalate cases where we believe your rights under UK GDPR are not being upheld.
If your GP practice refuses to cooperate or attempts to charge unfairly, let us know. We’re here to help.