Our ref: NIC-42567-D3J7N 
                                                                                                               29th March 2010 
Dear Ms Griffiths, 
 
 
 
 
 
 
 
 
 
 
Re: Information Request – Freedom of Information Act 2000 
 
I can confirm that the NHS Information Centre for Health and Social Care has considered your 
query dated the 5th March 2010.  
 
“Please provide the following information regarding your responsibilities under the Data 
Protection Act (DPA): 
 
1.  How many requests do you get under the DPA each year? 
2.  How do you verify the authenticity of DPA requests? 
3.  Do you conduct regular DPA audits/have an auditing policy? 
4.  Do you maintain data on errors in information covered by the DPA? 
 
a.  If so, please provide data for the past 5 years.” 
 
Thank you for your request; I can confirm that the NHS Information Centre dealt with 42 
Subject Access Requests under the Data Protection Act from April 2009 to date.  
 
The NHS IC requests the following documentation to verify the authenticity of DPA requests: 
 
Confirmation of name – Where there has been a change of name we require evidence of the 
name for which information is being sought e.g. a birth certificate will not be considered as 
evidence for searches on a married name.  
 
•  Full driving licence 
• Passport 
• Birth 
certificate 
• Marriage 
certificate 
•  NHS Information Centre identity badge (for current members of staff) 
 
Confirmation of address 
 
• Utility 
bill 
• Bank 
statement 
•  Credit card statement 
• Benefit 
book 
• Pension 
book 
 
 
 

---

 
 
 
 
I can also confirm that the NHS IC does conduct DPA audits. I can also confirm the NHS IC 
does not have an auditing policy, although our Legal Compliance Policy details the 
organisations responsibilities including audits within this area. 
 
Finally I can confirm that we do maintain data on errors in information covered by the DPA. 
However, we have not yet been asked to correct an error further to a subject access request 
under the DPA. 
 
I hope that this response meets your request for information. However, if you are not satisfied, 
you may request a review from a suitably qualified member of staff not involved in the initial 
query, via the [NHS Information Centre request email] e mail address or by post at the above postal address. 
 
I will assume that your request to the organisation is now closed. 
 
 
Yours sincerely, 
 
 
Julie Shippen 
Higher Information Governance Officer 
 
The re-use of this information for any purpose is subject to the Re-use of Public Sector 
Information Regulations 2005. Should you wish to re-use this information in any way you must 
ask us for specific permission relating to that you wish to use. If we agree to such re-use it 
may be subject to licensing and may involve a fee. Applications for re-use should be 
submitted to [NHS Information Centre request email]. No re-use should take place until you have formally asked 
for permission and we have informed you of our decision.  
 
 
 
 
 
Further information about your right to complain under the Freedom of Information Act is available from 
the Information Commissioner’s Office, Wilmslow, Cheshire, and on The Information Commissioner’s 
website www.ico.gov.uk. 
 
 
 
 
 

---